Security readout for executives and security teams
Plain-English summary
CVE-2025-22097 is a Linux kernel memory-safety flaw in the vkms graphics driver error path. If driver initialization fails, the cleanup code may use or free invalid memory. The CVSS score is high, but the published vector indicates local, low-privilege access is required; there is no cited evidence of active exploitation.
Executive priority
Treat as a high-priority kernel maintenance item, especially for shared Linux infrastructure. It is not currently supported by cited evidence of active exploitation, but kernel memory corruption can have serious confidentiality, integrity, and availability impact if reachable locally.
Technical view
The issue is a CWE-416 use-after-free/double-free in drm/vkms. vkms_exit() may access an uninitialized or freed default_config pointer after initialization failure. Kernel stable commits fix this by initializing default_config only after successful driver initialization. CVSS 3.1 is 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Likely exposure
Systems running affected Linux kernel versions with the vkms DRM driver code present are the relevant exposure. Risk is most important on multi-user Linux hosts, developer systems, CI runners, and desktops where local users or workloads may interact with kernel graphics components.
Exploitation context
The provided sources do not show public exploitation or CISA KEV listing. The CVSS vector indicates exploitation is local, requires low privileges, and needs no user interaction. The vulnerable condition is tied to a vkms driver initialization failure path, not a remote network service.
Researcher notes
Evidence is limited to the CVE record, Linux stable commits, and a Debian LTS advisory. The affected version data in the bundle mixes commit identifiers and kernel release numbers, so validate against distribution backports rather than upstream version numbers alone.
Mitigation direction
- Apply vendor kernel updates containing the referenced stable fixes.
- For Debian LTS systems, review the linked Debian advisory and update accordingly.
- If immediate patching is not possible, check vendor guidance for safe interim mitigations.
- Prioritize shared or multi-user Linux systems before single-user controlled hosts.
Validation and detection
- Inventory Linux kernel versions across servers, desktops, containers hosts, and CI runners.
- Check whether installed kernels include the referenced stable commits or vendor backports.
- Confirm Debian LTS hosts have applied the relevant linux package advisory updates.
- Review kernel configuration and module inventory for vkms exposure where operationally relevant.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-22097 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/49a69f67f53518bdd9b7eeebf019a2da6cc0e954CVE reference, Linux
- https://git.kernel.org/stable/c/79d138d137b80eeb0a83244d1cff29e64cf91067CVE reference, Linux
- https://git.kernel.org/stable/c/561fc0c5cf41f646f3e9e61784cbc0fc832fb936CVE reference, Linux
- https://git.kernel.org/stable/c/d5eb8e347905ab17788a7903fa1d3d06747355f5CVE reference, Linux
- https://git.kernel.org/stable/c/b8a18bb53e06d6d3c1fd03d12533d6e333ba8853CVE reference, Linux
- https://git.kernel.org/stable/c/1f68f1cf09d06061eb549726ff8339e064eddebdCVE reference, Linux
- https://git.kernel.org/stable/c/ed15511a773df86205bda66c37193569575ae828CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.