BlackTreeIndependent security intelligence

Full vulnerability report · 2025

CVE-2025-22019High confidence

bcachefs: bch2_ioctl_subvolume_destroy() fixes

Linux · Linux

7.3HighCVSS 3.1

Recommended action

Within 7 days

High technical severity; prioritise exposed affected systems while verifying vendor guidance.

Patch available

Distribution package intelligence

Ubuntu vendor package status

Canonical’s release and source-package findings are shown separately from local repository availability.

20 package states

Repository candidate not checked

A published vendor fix does not prove that a matching update is enabled and installable on a particular asset. Confirm the local package candidate before scheduling remediation.

Ubuntu release	Source package	Vendor state	Fixed version	Evidence
Ubuntu 24.04 LTSnoble · standard archive	`linux`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-aws`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-azure`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-azure-nvidia`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-gcp`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-gke`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-gkeop`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-ibm`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-intel`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-lowlatency`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-nvidia`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-nvidia-lowlatency`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-nvidia-tegra`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-oem-6.11`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-oracle`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-raspi`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-raspi-realtime`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-realtime`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-riscv`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-xilinx`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 8 Sept 2026

Official European source

ENISA European Vulnerability Database

Official EUVD identifiers, advisory evidence and known-exploited context. Missing fields are not treated as evidence of low risk.

1 current

ENISA EUVD identifier

EUVD-2025-11375

No EUVD known-exploited evidence

ENISA has published the identifier mapping but no EUVD description has been stored yet.

EUVD state: Present in the current official mapping
Known exploitation: Not present in the current ENISA EUVD known-exploited dataset. This is not proof of no exploitation.
ENISA score: Not supplied in the stored EUVD record
Advisory evidence: No linked advisory details stored yet

Recommended actionWithin 7 days

High technical severity; prioritise exposed affected systems while verifying vendor guidance.

Patch available

What, why and how

In the Linux kernel, the following vulnerability has been resolved: bcachefs: bch2_ioctl_subvolume_destroy() fixes bch2_evict_subvolume_inodes() was getting stuck - due to incorrectly pruning the dcache. Also, fix missing permissions checks.

What

Why

The current structured CVE record identifies a security weakness, but the root cause requires confirmation in the linked vendor material.

How

An attacker operating through local access may attempt exploitation with low privileges. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.

What

Why

The current structured CVE record identifies a security weakness, but the root cause requires confirmation in the linked vendor material.

How

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

No confirmed evidence

No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.

Public PoC / exploit material

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

None recorded

No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.

Likely attack path: local access → vulnerable operation → cause the confidentiality, integrity or availability impact described by the vendor
Attack surface: Local
Privileges required: Low: a basic authenticated account is required
User interaction: None
Attack complexity: Low: no specialised conditions are recorded
Security boundary: Unchanged: impact remains within the vulnerable component's security authority
Weakness ? CWE means Common Weakness Enumeration.: CWE not yet assigned
CVSS vector ? CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Common Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
AVLocalAttack vector: The attacker needs local access to the vulnerable system.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRLowPrivileges required: The attacker needs basic user-level privileges.UINoneUser interaction: No action by another user is required.SUnchangedScope: The security impact remains within the vulnerable component's authority.CLowConfidentiality impact: A successful attack can cause a limited loss.IHighIntegrity impact: A successful attack can cause a major loss.AHighAvailability impact: A successful attack can cause a major loss.
Post-exploitation / living off the land: The issue can support a local privilege or sandbox boundary transition; normal system utilities may then be available in the gained context.

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

ENISA EUVD · EUVD-2025-11375Official EUVD mapping

0 linked advisory records.

Official EUVD record

BSI · German · WID-SEC-W-2025-0837Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service Zustand herbeizuführen oder nicht näher beschriebene Auswirkungen zu erzielen.

Official advisory

CERT-FR · French · CERTFR-2026-AVI-0326Multiples vulnérabilités dans les produits VMware

d?id=CVE-2025-21945 Référence CVE CVE-2025-21946 https://www.cve.org/CVERecord?id=CVE-2025-21946 Référence CVE CVE-2025-21947 https://www.cve.org/CVERecord?id=CVE-2025-21947 Référence CVE CVE-2025-21955 https://www.cve.org/CVERecord?id=CVE-2025-21955 Référence CVE CVE-2025-21967 https://www.cve.org/CVERecord?id=CVE-2025-21967 Référence CVE CVE-2025-21972 https://www.cve.org/CVERecord?id=CVE-2025-21972 Référence CVE CVE-2025-21976 https://www.cve.org/CVERecord?id=CVE-2025-21976 Référence CVE CVE-2025-21985 https://www.cve.org/CVERecord?id=CVE-2025-21985 Référence CVE CVE-2025-21986 https://www.cve.org/CVERecord?id=CVE-2025-21986 Référence CVE CVE-2025-22019 https://www.cve.org/CVERecord?id=CVE-2025-22019 Référence CVE CVE-2025-22022 https://www.cve.org/CVERecord?id=CVE-2025-22022 Référence CVE CVE-2025-22026 https://www.cve.org/CVERecord?id=CVE-2025-22026 Référence CVE CVE-2025-22028 https://www.cve.org/CVERecord?id=CVE-2025-22028 Référence CVE CVE-2025-22037 https://www.cve.org/CVERecord?id=CVE-2025-22037 Référence CVE CVE-2025-22038 https://www.cve.org/CVERecord?id=CVE-2025-22038 Référence CVE CVE-2025-22039 https://www.cve.org/CVERecord?id=CVE-2025-22039 Référence CVE CVE-2025-22040 https://www.cve.org/CVERecord?id=CVE-2025-22040 Référence CVE CVE-2025-22041 https://www.cve.org/CVERecord?id=

Official advisory

CERT-FR · French · CERTFR-2026-AVI-0316Multiples vulnérabilités dans les produits VMware

Official advisory

CERT-FR · French · CERTFR-2026-AVI-0058Multiples vulnérabilités dans le noyau Linux d'Ubuntu

d?id=CVE-2024-50067 Référence CVE CVE-2024-50095 https://www.cve.org/CVERecord?id=CVE-2024-50095 Référence CVE CVE-2024-50196 https://www.cve.org/CVERecord?id=CVE-2024-50196 Référence CVE CVE-2024-53090 https://www.cve.org/CVERecord?id=CVE-2024-53090 Référence CVE CVE-2024-53218 https://www.cve.org/CVERecord?id=CVE-2024-53218 Référence CVE CVE-2024-58092 https://www.cve.org/CVERecord?id=CVE-2024-58092 Référence CVE CVE-2025-21729 https://www.cve.org/CVERecord?id=CVE-2025-21729 Référence CVE CVE-2025-21855 https://www.cve.org/CVERecord?id=CVE-2025-21855 Référence CVE CVE-2025-22018 https://www.cve.org/CVERecord?id=CVE-2025-22018 Référence CVE CVE-2025-22019 https://www.cve.org/CVERecord?id=CVE-2025-22019 Référence CVE CVE-2025-22020 https://www.cve.org/CVERecord?id=CVE-2025-22020 Référence CVE CVE-2025-22021 https://www.cve.org/CVERecord?id=CVE-2025-22021 Référence CVE CVE-2025-22025 https://www.cve.org/CVERecord?id=CVE-2025-22025 Référence CVE CVE-2025-22027 https://www.cve.org/CVERecord?id=CVE-2025-22027 Référence CVE CVE-2025-22028 https://www.cve.org/CVERecord?id=CVE-2025-22028 Référence CVE CVE-2025-22033 https://www.cve.org/CVERecord?id=CVE-2025-22033 Référence CVE CVE-2025-22035 https://www.cve.org/CVERecord?id=CVE-2025-22035 Référence CVE CVE-2025-22036 https://www.cve.org/CVERecord?id=

Official advisory

CERT-FR · French · CERTFR-2025-AVI-1135Multiples vulnérabilités dans le noyau Linux d'Ubuntu

d?id=CVE-2025-21715 Référence CVE CVE-2025-21722 https://www.cve.org/CVERecord?id=CVE-2025-21722 Référence CVE CVE-2025-21727 https://www.cve.org/CVERecord?id=CVE-2025-21727 Référence CVE CVE-2025-21729 https://www.cve.org/CVERecord?id=CVE-2025-21729 Référence CVE CVE-2025-21761 https://www.cve.org/CVERecord?id=CVE-2025-21761 Référence CVE CVE-2025-21791 https://www.cve.org/CVERecord?id=CVE-2025-21791 Référence CVE CVE-2025-21811 https://www.cve.org/CVERecord?id=CVE-2025-21811 Référence CVE CVE-2025-21855 https://www.cve.org/CVERecord?id=CVE-2025-21855 Référence CVE CVE-2025-22018 https://www.cve.org/CVERecord?id=CVE-2025-22018 Référence CVE CVE-2025-22019 https://www.cve.org/CVERecord?id=CVE-2025-22019 Référence CVE CVE-2025-22020 https://www.cve.org/CVERecord?id=CVE-2025-22020 Référence CVE CVE-2025-22021 https://www.cve.org/CVERecord?id=CVE-2025-22021 Référence CVE CVE-2025-22025 https://www.cve.org/CVERecord?id=CVE-2025-22025 Référence CVE CVE-2025-22027 https://www.cve.org/CVERecord?id=CVE-2025-22027 Référence CVE CVE-2025-22028 https://www.cve.org/CVERecord?id=CVE-2025-22028 Référence CVE CVE-2025-22033 https://www.cve.org/CVERecord?id=CVE-2025-22033 Référence CVE CVE-2025-22035 https://www.cve.org/CVERecord?id=CVE-2025-22035 Référence CVE CVE-2025-22036 https://www.cve.org/CVERecord?id=

Official advisory

CERT-FR · French · CERTFR-2025-AVI-1050Multiples vulnérabilités dans le noyau Linux d'Ubuntu

ubuntu.com/security/notices/USN-7879-3 Bulletin de sécurité Ubuntu USN-7889-2 du 26 novembre 2025 https://ubuntu.com/security/notices/USN-7889-2 Bulletin de sécurité Ubuntu USN-7889-3 du 26 novembre 2025 https://ubuntu.com/security/notices/USN-7889-3 Référence CVE CVE-2023-53034 https://www.cve.org/CVERecord?id=CVE-2023-53034 Référence CVE CVE-2024-36331 https://www.cve.org/CVERecord?id=CVE-2024-36331 Référence CVE CVE-2024-58092 https://www.cve.org/CVERecord?id=CVE-2024-58092 Référence CVE CVE-2025-21729 https://www.cve.org/CVERecord?id=CVE-2025-21729 Référence CVE CVE-2025-22018 https://www.cve.org/CVERecord?id=CVE-2025-22018 Référence CVE CVE-2025-22019 https://www.cve.org/CVERecord?id=CVE-2025-22019 Référence CVE CVE-2025-22020 https://www.cve.org/CVERecord?id=CVE-2025-22020 Référence CVE CVE-2025-22021 https://www.cve.org/CVERecord?id=CVE-2025-22021 Référence CVE CVE-2025-22025 https://www.cve.org/CVERecord?id=CVE-2025-22025 Référence CVE CVE-2025-22027 https://www.cve.org/CVERecord?id=CVE-2025-22027 Référence CVE CVE-2025-22028 https://www.cve.org/CVERecord?id=CVE-2025-22028 Référence CVE CVE-2025-22033 https://www.cve.org/CVERecord?id=CVE-2025-22033 Référence CVE CVE-2025-22035 https://www.cve.org/CVERecord?id=CVE-2025-22035 Référence CVE CVE-2025-22036 https://www.cve.org/CVERecord?id=

Official advisory

CERT-FR · French · CERTFR-2025-AVI-1008Multiples vulnérabilités dans le noyau Linux d'Ubuntu

d?id=CVE-2024-49924 Référence CVE CVE-2024-50006 https://www.cve.org/CVERecord?id=CVE-2024-50006 Référence CVE CVE-2024-50299 https://www.cve.org/CVERecord?id=CVE-2024-50299 Référence CVE CVE-2024-53124 https://www.cve.org/CVERecord?id=CVE-2024-53124 Référence CVE CVE-2024-53150 https://www.cve.org/CVERecord?id=CVE-2024-53150 Référence CVE CVE-2024-56767 https://www.cve.org/CVERecord?id=CVE-2024-56767 Référence CVE CVE-2024-58092 https://www.cve.org/CVERecord?id=CVE-2024-58092 Référence CVE CVE-2025-21796 https://www.cve.org/CVERecord?id=CVE-2025-21796 Référence CVE CVE-2025-22018 https://www.cve.org/CVERecord?id=CVE-2025-22018 Référence CVE CVE-2025-22019 https://www.cve.org/CVERecord?id=CVE-2025-22019 Référence CVE CVE-2025-22020 https://www.cve.org/CVERecord?id=CVE-2025-22020 Référence CVE CVE-2025-22021 https://www.cve.org/CVERecord?id=CVE-2025-22021 Référence CVE CVE-2025-22025 https://www.cve.org/CVERecord?id=CVE-2025-22025 Référence CVE CVE-2025-22027 https://www.cve.org/CVERecord?id=CVE-2025-22027 Référence CVE CVE-2025-22028 https://www.cve.org/CVERecord?id=CVE-2025-22028 Référence CVE CVE-2025-22033 https://www.cve.org/CVERecord?id=CVE-2025-22033 Référence CVE CVE-2025-22035 https://www.cve.org/CVERecord?id=CVE-2025-22035 Référence CVE CVE-2025-22036 https://www.cve.org/CVERecord?id=

Official advisory

CERT-FR · French · CERTFR-2025-AVI-0977Multiples vulnérabilités dans le noyau Linux d'Ubuntu

d?id=CVE-2024-36357 Référence CVE CVE-2024-50006 https://www.cve.org/CVERecord?id=CVE-2024-50006 Référence CVE CVE-2024-50299 https://www.cve.org/CVERecord?id=CVE-2024-50299 Référence CVE CVE-2024-53124 https://www.cve.org/CVERecord?id=CVE-2024-53124 Référence CVE CVE-2024-53150 https://www.cve.org/CVERecord?id=CVE-2024-53150 Référence CVE CVE-2024-56767 https://www.cve.org/CVERecord?id=CVE-2024-56767 Référence CVE CVE-2024-58092 https://www.cve.org/CVERecord?id=CVE-2024-58092 Référence CVE CVE-2025-21796 https://www.cve.org/CVERecord?id=CVE-2025-21796 Référence CVE CVE-2025-22018 https://www.cve.org/CVERecord?id=CVE-2025-22018 Référence CVE CVE-2025-22019 https://www.cve.org/CVERecord?id=CVE-2025-22019 Référence CVE CVE-2025-22020 https://www.cve.org/CVERecord?id=CVE-2025-22020 Référence CVE CVE-2025-22021 https://www.cve.org/CVERecord?id=CVE-2025-22021 Référence CVE CVE-2025-22025 https://www.cve.org/CVERecord?id=CVE-2025-22025 Référence CVE CVE-2025-22027 https://www.cve.org/CVERecord?id=CVE-2025-22027 Référence CVE CVE-2025-22028 https://www.cve.org/CVERecord?id=CVE-2025-22028 Référence CVE CVE-2025-22033 https://www.cve.org/CVERecord?id=CVE-2025-22033 Référence CVE CVE-2025-22035 https://www.cve.org/CVERecord?id=CVE-2025-22035 Référence CVE CVE-2025-22036 https://www.cve.org/CVERecord?id=

Official advisory

CERT-FR · French · CERTFR-2025-AVI-0922Multiples vulnérabilités dans le noyau Linux d'Ubuntu

d?id=CVE-2024-36357 Référence CVE CVE-2024-38541 https://www.cve.org/CVERecord?id=CVE-2024-38541 Référence CVE CVE-2024-49924 https://www.cve.org/CVERecord?id=CVE-2024-49924 Référence CVE CVE-2024-49950 https://www.cve.org/CVERecord?id=CVE-2024-49950 Référence CVE CVE-2024-50073 https://www.cve.org/CVERecord?id=CVE-2024-50073 Référence CVE CVE-2024-57996 https://www.cve.org/CVERecord?id=CVE-2024-57996 Référence CVE CVE-2024-58092 https://www.cve.org/CVERecord?id=CVE-2024-58092 Référence CVE CVE-2025-21796 https://www.cve.org/CVERecord?id=CVE-2025-21796 Référence CVE CVE-2025-22018 https://www.cve.org/CVERecord?id=CVE-2025-22018 Référence CVE CVE-2025-22019 https://www.cve.org/CVERecord?id=CVE-2025-22019 Référence CVE CVE-2025-22020 https://www.cve.org/CVERecord?id=CVE-2025-22020 Référence CVE CVE-2025-22021 https://www.cve.org/CVERecord?id=CVE-2025-22021 Référence CVE CVE-2025-22025 https://www.cve.org/CVERecord?id=CVE-2025-22025 Référence CVE CVE-2025-22027 https://www.cve.org/CVERecord?id=CVE-2025-22027 Référence CVE CVE-2025-22028 https://www.cve.org/CVERecord?id=CVE-2025-22028 Référence CVE CVE-2025-22033 https://www.cve.org/CVERecord?id=CVE-2025-22033 Référence CVE CVE-2025-22035 https://www.cve.org/CVERecord?id=CVE-2025-22035 Référence CVE CVE-2025-22036 https://www.cve.org/CVERecord?id=

Official advisory

CERT-FR · French · CERTFR-2025-AVI-0589Multiples vulnérabilités dans le noyau Linux d'Ubuntu

d?id=CVE-2025-22009 Référence CVE CVE-2025-22010 https://www.cve.org/CVERecord?id=CVE-2025-22010 Référence CVE CVE-2025-22011 https://www.cve.org/CVERecord?id=CVE-2025-22011 Référence CVE CVE-2025-22013 https://www.cve.org/CVERecord?id=CVE-2025-22013 Référence CVE CVE-2025-22014 https://www.cve.org/CVERecord?id=CVE-2025-22014 Référence CVE CVE-2025-22015 https://www.cve.org/CVERecord?id=CVE-2025-22015 Référence CVE CVE-2025-22016 https://www.cve.org/CVERecord?id=CVE-2025-22016 Référence CVE CVE-2025-22017 https://www.cve.org/CVERecord?id=CVE-2025-22017 Référence CVE CVE-2025-22018 https://www.cve.org/CVERecord?id=CVE-2025-22018 Référence CVE CVE-2025-22019 https://www.cve.org/CVERecord?id=CVE-2025-22019 Référence CVE CVE-2025-22020 https://www.cve.org/CVERecord?id=CVE-2025-22020 Référence CVE CVE-2025-22021 https://www.cve.org/CVERecord?id=CVE-2025-22021 Référence CVE CVE-2025-22022 https://www.cve.org/CVERecord?id=CVE-2025-22022 Référence CVE CVE-2025-22023 https://www.cve.org/CVERecord?id=CVE-2025-22023 Référence CVE CVE-2025-22024 https://www.cve.org/CVERecord?id=CVE-2025-22024 Référence CVE CVE-2025-22025 https://www.cve.org/CVERecord?id=CVE-2025-22025 Référence CVE CVE-2025-22026 https://www.cve.org/CVERecord?id=CVE-2025-22026 Référence CVE CVE-2025-22027 https://www.cve.org/CVERecord?id=

Official advisory

CERT-FR · French · CERTFR-2025-AVI-0559Multiples vulnérabilités dans le noyau Linux d'Ubuntu

Official advisory

Patch and workaround

Operational remediation based on structured source evidence.

Status ? Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.: Patch available
Affected: 1c6fdbd8f2465ddfb73a01ec620cbf3d14044e1a < 9e6e83e1e2d01b99e70cd7812d7f758a8def9fc8; 1c6fdbd8f2465ddfb73a01ec620cbf3d14044e1a < 82383abd39abd635511b8956284a5cc8134c4dc1; 1c6fdbd8f2465ddfb73a01ec620cbf3d14044e1a < 558317a5c61045d460a37372181e7b43c0c002bb; 1c6fdbd8f2465ddfb73a01ec620cbf3d14044e1a < 707549600c4a012ed71c0204a7992a679880bf33; 6.7
Fixed: < 6.7; 6.12.22 ≤ 6.12.*; 6.13.10 ≤ 6.13.*; 6.14.2 ≤ 6.14.*; 6.15 ≤ *
Action: Review the linked authoritative reference and apply the recorded fixed release appropriate to the affected product branch.
Workaround: No verified workaround is recorded. Limit untrusted access and use least privilege until authoritative guidance is available.

Evidence and provenance

Published 16 Apr 2025 · Last source change 5 Aug 2026, 11:56 UTC · CWE not yet assigned

CVE recordCVE.org · 5.2

CVSS sourceCNA

EPSS source

The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.

FIRST · tracked since 2026-08-14

European sourceENISA EUVD · EUVD-2025-11375

Product sourceCNA

Remediation sourceCVE/CNA references

CWE sourceUnavailable

NVD statusNVD modified after enrichment

Missing structured fields: CWE classification. Missing data is not evidence of low risk; review the primary advisory.

Material change intelligence

What changed after publication

View recent updates →

No material field changes have been recorded since change tracking began. Routine source refreshes and cosmetic edits are intentionally excluded.

2025-04-16CVE published

2026-08-05Fixed release or patch reference recorded

ENISA EUVD · EUVD-2025-11375↗CVE authority or vendor reference↗Patch or update reference↗Patch or update reference↗Patch or update reference↗Official CVE record (CNA and ADP data)↗NVD record↗

Technical terms and abbreviations used in this report

CVE: Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS: Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS: Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE: Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA: CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP: Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD: National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT: A computer security incident response team that publishes warnings or coordinates incident response.
PoC: Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF: Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL: Living off the land: abuse of legitimate tools or system functions during an attack.

bcachefs: bch2_ioctl_subvolume_destroy() fixes

National CERT insights ?CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

EUVD-2025-11375

What, why and how

Exploit reality and attack path

Official authority intelligence

Patch and workaround

Evidence and provenance

National CERT insights
?
CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.