Security readout for executives and security teams
Plain-English summary
A Linux kernel networking flaw can cause a serious kernel memory fault when cached network routes are released. Exposure depends on a specific configuration: CONFIG_DST_CACHE with Open vSwitch and tunnels. A successful trigger could compromise confidentiality, integrity, and availability according to the supplied CVSS assessment, but the sources provide no evidence of active exploitation.
Executive priority
Treat this as a high-priority kernel maintenance issue for virtualization, networking, and container infrastructure using Open vSwitch tunnels. Rapidly identify matching configurations, then deploy supported kernel updates through normal change controls. Systems without the required configuration appear less likely to be exposed, but the ambiguous version data warrants vendor confirmation.
Technical view
An earlier networking change moved destination-entry counter decrements into dst_release() to prevent access to freed data during network-namespace teardown. It did not fully handle cached destinations. With CONFIG_DST_CACHE and OvS tunnels, cache destruction can reach invalid memory. The stable fixes invalidate the cache during dst_release(), ensuring cached destination counters are decremented safely.
Likely exposure
Likely exposure is limited to Linux systems using kernels identified by the CVE record, compiled with CONFIG_DST_CACHE, and running Open vSwitch with tunnels. The supplied version list is ambiguous and includes commit identifiers and unusual boundaries, so confirm exposure against distribution advisories and the referenced stable commits.
Exploitation context
The CVSS 3.1 score is 7.8 with local access, low complexity, low privileges, and no user interaction. The supplied record is not in KEV and contains no evidence of exploitation in the wild. It documents a kernel paging fault, while the CVSS assessment indicates potentially high confidentiality, integrity, and availability impact.
Researcher notes
The failure involves destination-cache lifetime and accounting during release and network-namespace teardown. The documented trace passes through dst_release(), dst_cache_destroy(), and RCU destruction before faulting in percpu counter handling. Validate fixes branch-by-branch: the references contain separate stable backports, and the supplied affected-version representation is insufficient for reliable range inference.
Mitigation direction
- Apply the appropriate Linux distribution or stable-kernel update containing the referenced fix.
- Match the installed kernel branch against the corresponding stable commit before scheduling remediation.
- Prioritize systems using Open vSwitch tunnels and kernels built with CONFIG_DST_CACHE.
- If updating is delayed, consult the Linux distributor for supported mitigations or configuration guidance.
Validation and detection
- Record installed kernel versions and compare them with distribution advisories and stable fixes.
- Verify whether each kernel configuration enables CONFIG_DST_CACHE.
- Identify hosts running Open vSwitch with tunnel interfaces.
- After updating, confirm the running kernel includes the branch-appropriate fix.
- Review kernel logs for paging faults matching the documented dst_release and dst_cache_destroy call path.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-22057 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ccc331fd5bcae131d2627d5ef099d4a1f6540aeaCVE reference, Linux
- https://git.kernel.org/stable/c/92a5c18513117be69bc00419dd1724c1940f8fcdCVE reference, Linux
- https://git.kernel.org/stable/c/836415a8405c9665ae55352fc5ba865c242f5e4fCVE reference, Linux
- https://git.kernel.org/stable/c/e833e7ad64eb2f63867f65303be49ca30ee8819eCVE reference, Linux
- https://git.kernel.org/stable/c/3a0a3ff6593d670af2451ec363ccb7b18aec0c0aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.