Security readout for executives and security teams
Plain-English summary
A local user with limited privileges may trigger a Linux kernel memory read beyond its intended boundary by supplying a specially sized Geneve networking option. This could expose sensitive kernel memory or crash the system. The issue does not require user interaction, but the supplied evidence does not show remote or active exploitation.
Executive priority
Prioritize remediation in the next normal high-severity patch cycle, accelerating shared hosts and systems exposed to untrusted local workloads. Immediate emergency action is not supported by the supplied exploitation evidence, but confidentiality loss and kernel crashes make prolonged deferral inappropriate.
Technical view
Geneve options encode length in five bits. An exact 128-byte option can overflow that field to zero, confuse Netlink parsing, and cause a heap out-of-bounds read. The supplied CVSS 3.1 score is 7.1, reflecting local access, low complexity, low privileges, high confidentiality impact, and high availability impact.
Likely exposure
Exposure is most likely on affected Linux kernels where a local attacker can reach the relevant Geneve, Netlink, or traffic-control paths. Containers, shared hosts, and other multi-user systems warrant particular review. The bundle lists affected kernel releases, but distribution backports make version-only conclusions unreliable.
Exploitation context
The source bundle includes a reproducer crash trace demonstrating the flaw, but provides no evidence of attacks in the wild. The CVE is not listed as KEV. Treat public technical detail as increasing research interest, without interpreting crashes alone as proof of exploitation.
Researcher notes
The failure arises from mismatch between a five-bit Geneve option-length representation and Netlink policies accepting an exact 128-byte option. The resulting zero-length interpretation can desynchronize parsing and reach an out-of-bounds read during tunnel or traffic-control data handling. The bundle establishes a crash and patch commits, but not code execution, integrity impact, or active exploitation.
Mitigation direction
- Install a vendor-supported kernel containing the cited stable fix or an equivalent distribution backport.
- Consult the Linux distribution or appliance vendor for precise fixed-package guidance.
- Prioritize shared, container-hosting, and multi-user Linux systems with relevant networking capabilities.
- If patching is delayed, request vendor-supported mitigations; the supplied sources name no general workaround.
Validation and detection
- Inventory running kernel and package versions across Linux hosts and appliances.
- Check vendor advisories for backported fixes rather than relying solely on upstream version numbers.
- Confirm the installed kernel contains the applicable stable fix or vendor-equivalent change.
- Review kernel logs for relevant out-of-bounds crashes, while treating them as indicators rather than exploitation proof.
- Assess which local users or workloads can access Geneve, Netlink, or traffic-control functionality.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-22055 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a2cb85f989e2074e2f392e00188c438cab3de088CVE reference, Linux
- https://git.kernel.org/stable/c/b4513ad0f391871d3feee8ddf535609a3aabeeacCVE reference, Linux
- https://git.kernel.org/stable/c/21748669c5825761cbbf47cbeeb01387ddccc8cbCVE reference, Linux
- https://git.kernel.org/stable/c/5a2976cc4d9c36ff58a0f10e35ce4283cbaa9c0eCVE reference, Linux
- https://git.kernel.org/stable/c/2952776c69a1a551649ed770bf22e3f691f6ec65CVE reference, Linux
- https://git.kernel.org/stable/c/738ae5712215fe9181587d582b23333f02c62ca6CVE reference, Linux
- https://git.kernel.org/stable/c/4d606069bdd3c76f8ab1f06796c97ef7f4746807CVE reference, Linux
- https://git.kernel.org/stable/c/b27055a08ad4b415dcf15b63034f9cb236f7fb40CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.