CVE-2025-49491: 
NixOS vulnerability analysis and mitigation

CVE-2025-49491 is an Improper Resource Shutdown or Release vulnerability (CWE-404) affecting ASR Microelectronics' Falcon_Linux, Kestrel, and Lapwing_Linux operating systems on Linux platforms. The flaw resides in the traffic_stat modules, specifically in the traffic_stat/traffic_service/traffic_service.C program file, and allows resource leak exposure. All versions prior to v1536 are affected. It was published on July 1, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (ASR PSIRT, ENISA EUVD).

The vulnerability is classified under CWE-404 (Improper Resource Shutdown or Release) and stems from improper handling of resource lifecycle within the traffic_stat module's traffic_service.C source file. When network traffic is processed, resources are not properly released or shut down, leading to resource leaks that can accumulate over time. The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity, making it accessible to unauthenticated remote attackers. The associated CAPEC patterns include Flooding (CAPEC-125), Excessive Allocation (CAPEC-130), Resource Leak Exposure (CAPEC-131), and TCP/UDP/ICMP Fragmentation attacks (ASR PSIRT, ENISA EUVD).

Successful exploitation can result in system resource exhaustion, leading to service degradation or partial system instability on affected ASR Linux platforms. The confidentiality impact is low (potential resource leak exposure), and availability impact is low, with no integrity impact. Prolonged exploitation could cause progressive resource depletion, potentially rendering traffic management services unresponsive (ASR PSIRT, ENISA EUVD).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.037%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (ASR PSIRT, ENISA EUVD).

ASR Microelectronics has released a patch addressing this vulnerability; users should upgrade Falcon_Linux, Kestrel, and Lapwing_Linux to version v1536 or later. As interim mitigations, administrators should restrict network access to affected systems, implement strict network segmentation, and monitor system resources for unusual consumption patterns. Applying vendor-recommended security updates promptly is the primary recommended action (ASR PSIRT).

The vulnerability received limited community attention, with brief mentions on security-focused Mastodon accounts and automated vulnerability tracking feeds shortly after publication. No significant vendor statements beyond the ASR PSIRT advisory or notable researcher commentary have been identified (ASR PSIRT).