CVE-2025-21494

What it actually does

Local high-privileged attacker can abuse a privilege check in the Server: Security: Privileges component to trigger a hang or repeatable crash, resulting in complete denial of service for the MySQL Server process.

Why it matters to the business

Successful exploitation can cause unplanned downtime for database-dependent services, affecting availability of applications and workloads running on the listed Ubuntu kernels; the issue is local-only and difficult to trigger but requires immediate patching on affected systems.

How an attack unfolds

An attacker with administrative logon access to the host running an affected MySQL Server version crafts or invokes specific privileged operations that bypass intended authorization checks, leading to resource exhaustion or crash; no remote or unauthenticated vector exists and public exploit code is unavailable.

How to fix it

Upgrade affected packages to the listed fixed versions: linux-aws (Ubuntu 23.10) to 6.5.0-1021.21 and linux-oracle (Ubuntu 23.10) to 6.5.0-1024.24. Apply vendor updates for MySQL Server 8.0.40+, 8.4.3+, or 9.0.2+ where applicable and restart the service.

How to confirm the fix worked

Verify package versions match or exceed the fixed releases, confirm MySQL Server reports an updated build string, and test that the service starts and remains stable under normal privileged operations.

Typical attack path

1. Obtain high-privileged (root or equivalent) shell access on the MySQL host
2. Execute or trigger the vulnerable privilege-handling code path in the Server Security component
3. Cause the MySQL Server process to hang or crash, producing a denial-of-service condition

How to detect it

Review system and MySQL error logs for unexpected process terminations or hang events originating from privileged sessions; correlate with authentication logs showing administrative access immediately prior to the outage.

What your security team should do

• Prioritize patching the listed Ubuntu kernel packages on all affected hosts within the next maintenance window
• Restrict interactive logons for database hosts to the minimum required administrators
• Monitor for availability alerts on MySQL instances until patches are deployed