Security readout for executives and security teams
Plain-English summary
A locally authenticated user on a Linux system using RDMA or InfiniBand may trigger a kernel crash or memory corruption by accessing hardware-counter files from a non-default network namespace. This could disrupt shared hosts and potentially affect confidentiality or integrity. Exposure depends on the installed kernel, RDMA availability, and namespace access.
Executive priority
Prioritize shared compute, container platforms, and RDMA-intensive infrastructure because a low-privileged local user could destabilize the kernel. Patch through supported distribution channels promptly. Internet exposure alone does not establish reachability because the documented attack vector is local.
Technical view
An RDMA sysfs change incorrectly exposed device hardware-counter attributes in non-init network namespaces. Reading them can make hw_stat_device_show() derive an invalid ib_device pointer, causing a NULL dereference and memory corruption. The Linux fix suppresses the incompatible hw_counters attribute group outside the initial network namespace.
Likely exposure
Most likely affected are multi-user, containerized, or namespace-enabled Linux hosts with RDMA hardware and ib_core functionality. The supplied record identifies affected Linux kernel versions beginning with 5.14 and lists multiple stable-series fix boundaries, but exact distribution package status must be confirmed with its vendor.
Exploitation context
The CVSS 3.1 score is 7.8 with local access and low privileges required. The source demonstrates reproducibility and kernel impact, but provides no evidence of real-world exploitation. CVE-2025-22089 is not identified as a CISA KEV entry in the supplied bundle.
Researcher notes
The regression originated in commit 467f432a521a. The immediate fault is an invalid container_of-style device conversion in hw_stat_device_show(), while the underlying boundary failure is exposing device counters outside the init namespace. The supplied stable commits remove that exposure. Public evidence does not establish reliable privilege escalation or active exploitation.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix for CVE-2025-22089.
- Review distribution advisories to map the fix commits to installed kernel packages.
- Until patched, limit untrusted local or container access to RDMA-enabled hosts.
- Restrict creation or use of non-init network namespaces where operationally appropriate.
Validation and detection
- Inventory RDMA-enabled systems, loaded ib_core functionality, kernel versions, and namespace-enabled workloads.
- Confirm the installed kernel package includes the applicable upstream stable fix commit.
- In an authorized test environment, verify device hw_counters are unavailable inside a non-init network namespace.
- Monitor affected hosts for kernel oops, NULL-pointer dereferences, or crashes involving hw_stat_device_show.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-22089 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9a5b7f8842a90a5e6eeff37f9f6d814e61ea3529CVE reference, Linux
- https://git.kernel.org/stable/c/d5212b99649c5740154f307e9e3d7fee9bf62773CVE reference, Linux
- https://git.kernel.org/stable/c/0cf80f924aecb5b2bebd4f4ad11b2efc676a0b78CVE reference, Linux
- https://git.kernel.org/stable/c/df45ae2a4f1cdfda00c032839e12092e1f32c05eCVE reference, Linux
- https://git.kernel.org/stable/c/c14d9704f5d77a7c7fa46e2114b64a4f75b64e17CVE reference, Linux
- https://git.kernel.org/stable/c/6682da5d8fd578a5068531d01633c9d2e4c8f12bCVE reference, Linux
- https://git.kernel.org/stable/c/a1ecb30f90856b0be4168ad51b8875148e285c1fCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.