Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw can let a local low-privileged user crash an affected system by reaching a NetLabel/CALIPSO code path with mismatched IPv4 and IPv6 socket handling. The impact is availability only, not data theft or privilege escalation in the provided sources.
Executive priority
Treat as a normal-priority kernel availability fix. It is not a known actively exploited issue in the provided evidence, but shared Linux systems should be patched promptly because a local crash can disrupt services.
Technical view
The bug is a CWE-476 NULL pointer dereference in netlabel. An IPv4 socket passed an IPv6 connect address can route into calipso_sock_setattr(), where inet_sk(sk)->pinet6 is NULL. Kernel stable fixes add a NULL check before accessing the IPv6 socket state.
Likely exposure
Exposure is limited to affected Linux kernel versions where the NetLabel/CALIPSO path is present and reachable by a low-privileged local user. Internet-facing remote exploitation is not indicated by the CVSS vector or source bundle.
Exploitation context
The CVE has CVSS 5.5 with AV:L, PR:L, UI:N, and availability high. The bundle marks KEV false and provides no cited evidence of active exploitation, public exploit availability, or remote attack paths.
Researcher notes
The source evidence supports a local denial-of-service class issue, not confidentiality or integrity impact. The affected-version data in the bundle is incomplete as plain version strings, so rely on upstream stable commits and distribution advisories for exact package applicability.
Mitigation direction
- Apply vendor kernel updates that include the referenced stable fixes.
- For Debian LTS, review the listed Debian security announcements.
- Prioritize multi-user and multi-tenant Linux systems first.
- Check distribution advisories before assuming raw upstream version status.
- Reboot into the patched kernel after updating.
Validation and detection
- Inventory Linux kernel versions across servers and images.
- Confirm whether vendor packages include fixes for CVE-2025-22063.
- Verify running kernels after reboot, not only installed packages.
- Review local-user exposure on shared hosts and container platforms.
- Track Debian LTS advisory applicability for Debian systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-22063 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1ad9166cab6a0f5c0b10344a97bdf749ae11dcbfCVE reference, Linux
- https://git.kernel.org/stable/c/1e38f7a6cdd68377f8a4189b2fbaec14a6dd5152CVE reference, Linux
- https://git.kernel.org/stable/c/a7e89541d05b98c79a51c0f95df020f8e82b62edCVE reference, Linux
- https://git.kernel.org/stable/c/797e5371cf55463b4530bab3fef5f27f7c6657a8CVE reference, Linux
- https://git.kernel.org/stable/c/1927d0bcd5b81e80971bf6b8eba267508bd1c78bCVE reference, Linux
- https://git.kernel.org/stable/c/3ba9cf69de50e8abed32b448616c313baa4c5712CVE reference, Linux
- https://git.kernel.org/stable/c/9fe3839588db7519030377b7dee3f165e654f6c5CVE reference, Linux
- https://git.kernel.org/stable/c/172a8a996a337206970467e871dd995ac07640b1CVE reference, Linux
- https://git.kernel.org/stable/c/078aabd567de3d63d37d7673f714e309d369e6e2CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.