PT-2025-14284 · Linux+4 · Linux Kernel+4

Published 2025-03-04 · Updated 2026-04-20 · CVE-2025-21903

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue concerns the Linux kernel, specifically the mctp i3c component. It involves handling a NULL header address. The daddr can be NULL if there is no neighbour table entry present, in which case the tx packet should be dropped. The saddr is usually set by the MCTP core, but there is a check for NULL in case a packet is transmitted by a different protocol.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2025-04819

CVE-2025-21903

USN-7605-1

USN-7605-2

USN-7606-1

USN-7628-1

USN-7764-1

USN-7764-2

USN-7765-1

USN-7766-1

USN-7767-1

USN-7767-2

USN-7779-1

USN-7790-1

USN-7800-1

USN-7801-1

USN-7801-2

USN-7801-3

USN-7802-1

USN-7809-1

Affected Products

Astra Linux

Linuxmint

Linux Kernel

Red Os

Ubuntu

References · 279

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21903.json · Exploit
• https://ubuntu.com/security/CVE-2025-21880 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-22046 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-22095 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-39989 · Vendor Advisory
• https://git.kernel.org/stable/c/740bf9c9b715cc327d34b1e2d4ee79fcd4c47a56 · Patch
• https://ubuntu.com/security/CVE-2025-21920 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-21968 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38001 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-53034 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-22055 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7767-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-58092 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2025-21903 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-22035 · Vendor Advisory