Security readout for executives and security teams
Plain-English summary
A Linux kernel memory-alignment flaw affects LoongArch systems using certain DMA hardware. Small DMA buffers may be written incorrectly at the cacheline level, potentially causing data corruption, crashes, or broader confidentiality, integrity, and availability impacts. Exposure is architecture- and hardware-specific rather than universal across Linux deployments.
Executive priority
Treat as a high-priority targeted update for LoongArch environments, especially where affected DMA hardware is present. Organizations without LoongArch assets have low apparent exposure from the supplied evidence. Confirm inventory before escalating broadly, and use distribution-supported kernel packages where available.
Technical view
LoongArch previously defaulted ARCH_DMA_MINALIGN to one byte, although devices such as APBDMA require 16-byte alignment. DMA operations involving undersized buffers may therefore produce erroneous cacheline writes. The upstream resolution raises ARCH_DMA_MINALIGN to 16. The supplied CVSS 3.1 score is 7.8 and models local, low-privileged access without user interaction.
Likely exposure
Likely exposure is limited to affected LoongArch kernel builds, particularly systems using APBDMA or other DMA devices requiring 16-byte alignment. Non-LoongArch systems are not implicated by the supplied description. The bundle lists affected version entries, but does not clearly define complete distribution-specific ranges or backport status.
Exploitation context
The source bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. The CVSS vector indicates a local attack requiring low privileges, but the supplied sources do not describe a demonstrated attack mechanism.
Researcher notes
The record describes a DMA buffer-alignment safety issue but assigns no CWE and supplies no detailed failure trace or exploit evidence. Researchers should distinguish theoretical CVSS impact from demonstrated exploitation. Exact affected and fixed builds require commit ancestry or distribution advisory verification because the supplied version list is not expressed as clear ranges.
Mitigation direction
- Inventory LoongArch systems and identify kernels matching the affected version entries in the CVE record.
- Update through the relevant distribution or Linux stable release containing the referenced alignment fix.
- Prioritize LoongArch hosts using APBDMA or other DMA devices requiring 16-byte alignment.
- Review vendor guidance before relying on configuration changes or backports.
Validation and detection
- Confirm the running kernel architecture is LoongArch and record its exact distribution build.
- Verify the installed kernel includes the applicable stable commit or distribution backport.
- Check hardware and driver inventories for APBDMA and other alignment-sensitive DMA devices.
- Monitor kernel and device logs for DMA or cacheline write errors after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-22049 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f39af67f03b564b763b06e44cb960c10a382d54aCVE reference, Linux
- https://git.kernel.org/stable/c/279ec25c2df49fba1cd9488f2ddd045d9cb2112eCVE reference, Linux
- https://git.kernel.org/stable/c/1d0def2d1658666ec1f32c9495df60e7411e3c82CVE reference, Linux
- https://git.kernel.org/stable/c/bfff341cac7c650e6ca8d10503725992f5564d0fCVE reference, Linux
- https://git.kernel.org/stable/c/8b82aea3666f8f2c78f86148d78aea99c46e0f82CVE reference, Linux
- https://git.kernel.org/stable/c/4103cfe9dcb88010ae4911d3ff417457d1b6a720CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.