Security readout for executives and security teams
Plain-English summary
A Linux kernel networking driver trusted a packet-length value without confirming it stayed within the allowed maximum. On affected systems using this ICE driver path, a local low-privileged user could potentially cause serious confidentiality or availability impact. This is important for shared or virtualized hosts, but the supplied evidence does not show that every Linux system is exposed.
Executive priority
Treat this as an expedited patching priority for shared infrastructure using the ICE driver, especially where untrusted local users or workloads exist. Prioritize confirmed driver-path exposure rather than assuming all Linux systems are vulnerable. The high CVSS score supports urgency, although the supplied evidence does not establish active exploitation.
Technical view
The ICE driver function ice_vc_fdir_parse_raw() used proto->raw.pkt_len without first checking it against VIRTCHNL_MAX_SIZE_RAW_PACKET. The referenced kernel fixes add that bounds validation. CVSS 3.1 scores the issue 8.7, with local access, low privileges, low complexity, no user interaction, changed scope, and high confidentiality and availability impacts.
Likely exposure
Exposure requires an affected Linux kernel and use of the ICE virtual-channel Flow Director raw-packet handling path. The bundle identifies several versions, including 6.12, 6.12.80, 6.14.2, and 6.15, but does not provide unambiguous affected ranges. Distribution backports may change exposure independently of the displayed version.
Exploitation context
The CVSS vector describes local, low-privileged exploitation with low complexity and no user interaction. CISA KEV status is false, and the supplied sources do not document active exploitation or a public exploit. Absence from KEV does not prove that exploitation is impossible or has never occurred.
Researcher notes
The source bundle clearly identifies the missing upper-bound check and three stable-kernel fixes. However, its flattened version data does not define reliable introduction and remediation ranges. Validate affectedness through distribution advisories, package changelogs, and commit backports. The supplied material does not identify a CWE, demonstrated exploit, crash signature, or supported workaround.
Mitigation direction
- Apply a vendor-supported kernel update incorporating the applicable referenced stable fix.
- Prioritize shared or virtualized hosts actively using the ICE network driver.
- Check distribution security guidance because fixed status may depend on backported patches.
- If updating is delayed, request vendor-supported mitigations; the supplied sources name no workaround.
Validation and detection
- Inventory running kernel builds on systems using ICE-supported network hardware.
- Check distribution changelogs for backports of the referenced stable commits.
- Confirm updated systems rebooted into the remediated kernel build.
- Verify the applicable fix bounds pkt_len by VIRTCHNL_MAX_SIZE_RAW_PACKET.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-22117 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H26LinuxVulnerability scoring details
Base CVSS 3.1 score
8.7HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/363377af2c9e874fbba3a199408f8ec7b37906f7CVE reference, Linux
- https://git.kernel.org/stable/c/362f704ba73a359db9cded567e891d9a8f081875CVE reference, Linux
- https://git.kernel.org/stable/c/1388dd564183a5a18ec4a966748037736b5653c5CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.