Security readout for executives and security teams
Plain-English summary
This Linux kernel bug can make network interface information requests fail on systems with many SR-IOV virtual functions and VF GUID support. The reported impact is a kernel warning and failed link query, not remote code execution or data theft in the provided sources.
Executive priority
Treat this as a targeted reliability issue for specialized Linux networking hosts. Prioritize patching on virtualization, RDMA, or high-density SR-IOV infrastructure; it is not presented as broadly exploitable in the sources.
Technical view
rtnetlink underallocated netlink ifinfo messages after VF port and node GUID fields were added. When many VF GUIDs are present, filling the message can exceed the allocated size, producing RTNETLINK message-too-long errors and a kernel WARN in rtnl_getlink.
Likely exposure
Exposure appears concentrated on Linux systems using SR-IOV virtual functions with network/RDMA hardware that reports VF port and node GUIDs. Ordinary systems without such VF GUID-heavy configurations are less likely to encounter the condition.
Exploitation context
The source bundle does not show active exploitation, KEV listing, public exploit activity, or a remote attack path. Evidence describes a local operational trigger involving many VFs and a link information request.
Researcher notes
The key boundary is configuration-dependent impact. Sources identify underallocation in netlink message sizing for VF GUID attributes, with fixes in multiple stable commits, but provide no CVSS, CWE, exploitability analysis, or confirmed security impact beyond warning and request failure.
Mitigation direction
- Apply kernel or distribution updates containing the stable rtnetlink fix.
- Review Debian LTS advisories if running affected Debian LTS kernels.
- Check vendor kernel guidance for your exact distribution and kernel branch.
- Where patching is delayed, avoid high VF counts on affected systems if operationally feasible.
Validation and detection
- Inventory Linux hosts using SR-IOV virtual functions and RDMA or VF GUID-capable devices.
- Compare running kernel versions against vendor advisories and fixed stable commits.
- Check logs for rtnl_getlink warnings or RTNETLINK message-too-long errors.
- Confirm updated systems can retrieve link information without kernel warnings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-22075 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0f5489707cf528f9df2f39a3045c1ee713ec90e7CVE reference, Linux
- https://git.kernel.org/stable/c/bb7bdf636cef74cdd7a7d548bdc7457ae161f617CVE reference, Linux
- https://git.kernel.org/stable/c/5fed5f6de3cf734b231a11775748a6871ee3020fCVE reference, Linux
- https://git.kernel.org/stable/c/15f150771e0ec97f8ab1657e7d2568e593c7fa04CVE reference, Linux
- https://git.kernel.org/stable/c/28b21ee8e8fb326ba961a4bbce04ec04c65e705aCVE reference, Linux
- https://git.kernel.org/stable/c/365c1ae819455561d4746aafabad673e4bcb0163CVE reference, Linux
- https://git.kernel.org/stable/c/5f39454468329bb7fc7fc4895a6ba6ae3b95027eCVE reference, Linux
- https://git.kernel.org/stable/c/23f00807619d15063d676218f36c5dfeda1eb420CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.