CVE-2025-21634 (GCVE-0-2025-21634)

Vulnerability from cvelistv5 – Published: 2025-01-19 10:17 – Updated: 2025-10-01 19:57
VLAI?
Title
cgroup/cpuset: remove kernfs active break
Summary
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: remove kernfs active break A warning was found: WARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828 CPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G RIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0 RSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202 RAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000 RDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04 RBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180 R10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08 R13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0 FS: 00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kernfs_drain+0x15e/0x2f0 __kernfs_remove+0x165/0x300 kernfs_remove_by_name_ns+0x7b/0xc0 cgroup_rm_file+0x154/0x1c0 cgroup_addrm_files+0x1c2/0x1f0 css_clear_dir+0x77/0x110 kill_css+0x4c/0x1b0 cgroup_destroy_locked+0x194/0x380 cgroup_rmdir+0x2a/0x140 It can be explained by: rmdir echo 1 > cpuset.cpus kernfs_fop_write_iter // active=0 cgroup_rm_file kernfs_remove_by_name_ns kernfs_get_active // active=1 __kernfs_remove // active=0x80000002 kernfs_drain cpuset_write_resmask wait_event //waiting (active == 0x80000001) kernfs_break_active_protection // active = 0x80000001 // continue kernfs_unbreak_active_protection // active = 0x80000002 ... kernfs_should_drain_open_files // warning occurs kernfs_put_active This warning is caused by 'kernfs_break_active_protection' when it is writing to cpuset.cpus, and the cgroup is removed concurrently. The commit 3a5a6d0c2b03 ("cpuset: don't nest cgroup_mutex inside get_online_cpus()") made cpuset_hotplug_workfn asynchronous, This change involves calling flush_work(), which can create a multiple processes circular locking dependency that involve cgroup_mutex, potentially leading to a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 ("cpuset: break kernfs active protection in cpuset_write_resmask()") added 'kernfs_break_active_protection' in the cpuset_write_resmask. This could lead to this warning. After the commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing synchronous"), the cpuset_write_resmask no longer needs to wait the hotplug to finish, which means that concurrent hotplug and cpuset operations are no longer possible. Therefore, the deadlock doesn't exist anymore and it does not have to 'break active protection' now. To fix this warning, just remove kernfs_break_active_protection operation in the 'cpuset_write_resmask'.
Severity ?
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 76bb5ab8f6e3e7bebdcefec4146ff305e7d0b465 , < 11cb1d643a74665a4e14749414f48f82cbc15c64 (git)
Affected: 76bb5ab8f6e3e7bebdcefec4146ff305e7d0b465 , < 3cb97a927fffe443e1e7e8eddbfebfdb062e86ed (git)
Create a notification for this product.
    Linux Linux Affected: 3.16
Unaffected: 0 , < 3.16 (semver)
Unaffected: 6.12.10 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21634",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:54:20.155595Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-667",
                "description": "CWE-667 Improper Locking",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:18.437Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/cgroup/cpuset.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "11cb1d643a74665a4e14749414f48f82cbc15c64",
              "status": "affected",
              "version": "76bb5ab8f6e3e7bebdcefec4146ff305e7d0b465",
              "versionType": "git"
            },
            {
              "lessThan": "3cb97a927fffe443e1e7e8eddbfebfdb062e86ed",
              "status": "affected",
              "version": "76bb5ab8f6e3e7bebdcefec4146ff305e7d0b465",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/cgroup/cpuset.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.10",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: remove kernfs active break\n\nA warning was found:\n\nWARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828\nCPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G\nRIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0\nRSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202\nRAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000\nRDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04\nRBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180\nR10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08\nR13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0\nFS:  00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n kernfs_drain+0x15e/0x2f0\n __kernfs_remove+0x165/0x300\n kernfs_remove_by_name_ns+0x7b/0xc0\n cgroup_rm_file+0x154/0x1c0\n cgroup_addrm_files+0x1c2/0x1f0\n css_clear_dir+0x77/0x110\n kill_css+0x4c/0x1b0\n cgroup_destroy_locked+0x194/0x380\n cgroup_rmdir+0x2a/0x140\n\nIt can be explained by:\nrmdir \t\t\t\techo 1 \u003e cpuset.cpus\n\t\t\t\tkernfs_fop_write_iter // active=0\ncgroup_rm_file\nkernfs_remove_by_name_ns\tkernfs_get_active // active=1\n__kernfs_remove\t\t\t\t\t  // active=0x80000002\nkernfs_drain\t\t\tcpuset_write_resmask\nwait_event\n//waiting (active == 0x80000001)\n\t\t\t\tkernfs_break_active_protection\n\t\t\t\t// active = 0x80000001\n// continue\n\t\t\t\tkernfs_unbreak_active_protection\n\t\t\t\t// active = 0x80000002\n...\nkernfs_should_drain_open_files\n// warning occurs\n\t\t\t\tkernfs_put_active\n\nThis warning is caused by \u0027kernfs_break_active_protection\u0027 when it is\nwriting to cpuset.cpus, and the cgroup is removed concurrently.\n\nThe commit 3a5a6d0c2b03 (\"cpuset: don\u0027t nest cgroup_mutex inside\nget_online_cpus()\") made cpuset_hotplug_workfn asynchronous, This change\ninvolves calling flush_work(), which can create a multiple processes\ncircular locking dependency that involve cgroup_mutex, potentially leading\nto a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 (\"cpuset: break\nkernfs active protection in cpuset_write_resmask()\") added\n\u0027kernfs_break_active_protection\u0027 in the cpuset_write_resmask. This could\nlead to this warning.\n\nAfter the commit 2125c0034c5d (\"cgroup/cpuset: Make cpuset hotplug\nprocessing synchronous\"), the cpuset_write_resmask no longer needs to\nwait the hotplug to finish, which means that concurrent hotplug and cpuset\noperations are no longer possible. Therefore, the deadlock doesn\u0027t exist\nanymore and it does not have to \u0027break active protection\u0027 now. To fix this\nwarning, just remove kernfs_break_active_protection operation in the\n\u0027cpuset_write_resmask\u0027."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:17:55.268Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/11cb1d643a74665a4e14749414f48f82cbc15c64"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cb97a927fffe443e1e7e8eddbfebfdb062e86ed"
        }
      ],
      "title": "cgroup/cpuset: remove kernfs active break",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21634",
    "datePublished": "2025-01-19T10:17:52.983Z",
    "dateReserved": "2024-12-29T08:45:45.726Z",
    "dateUpdated": "2025-10-01T19:57:18.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21634\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-19T11:15:08.890\",\"lastModified\":\"2025-10-01T20:18:14.983\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncgroup/cpuset: remove kernfs active break\\n\\nA warning was found:\\n\\nWARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828\\nCPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G\\nRIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0\\nRSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202\\nRAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000\\nRDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04\\nRBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180\\nR10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08\\nR13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0\\nFS:  00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n kernfs_drain+0x15e/0x2f0\\n __kernfs_remove+0x165/0x300\\n kernfs_remove_by_name_ns+0x7b/0xc0\\n cgroup_rm_file+0x154/0x1c0\\n cgroup_addrm_files+0x1c2/0x1f0\\n css_clear_dir+0x77/0x110\\n kill_css+0x4c/0x1b0\\n cgroup_destroy_locked+0x194/0x380\\n cgroup_rmdir+0x2a/0x140\\n\\nIt can be explained by:\\nrmdir \\t\\t\\t\\techo 1 \u003e cpuset.cpus\\n\\t\\t\\t\\tkernfs_fop_write_iter // active=0\\ncgroup_rm_file\\nkernfs_remove_by_name_ns\\tkernfs_get_active // active=1\\n__kernfs_remove\\t\\t\\t\\t\\t  // active=0x80000002\\nkernfs_drain\\t\\t\\tcpuset_write_resmask\\nwait_event\\n//waiting (active == 0x80000001)\\n\\t\\t\\t\\tkernfs_break_active_protection\\n\\t\\t\\t\\t// active = 0x80000001\\n// continue\\n\\t\\t\\t\\tkernfs_unbreak_active_protection\\n\\t\\t\\t\\t// active = 0x80000002\\n...\\nkernfs_should_drain_open_files\\n// warning occurs\\n\\t\\t\\t\\tkernfs_put_active\\n\\nThis warning is caused by \u0027kernfs_break_active_protection\u0027 when it is\\nwriting to cpuset.cpus, and the cgroup is removed concurrently.\\n\\nThe commit 3a5a6d0c2b03 (\\\"cpuset: don\u0027t nest cgroup_mutex inside\\nget_online_cpus()\\\") made cpuset_hotplug_workfn asynchronous, This change\\ninvolves calling flush_work(), which can create a multiple processes\\ncircular locking dependency that involve cgroup_mutex, potentially leading\\nto a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 (\\\"cpuset: break\\nkernfs active protection in cpuset_write_resmask()\\\") added\\n\u0027kernfs_break_active_protection\u0027 in the cpuset_write_resmask. This could\\nlead to this warning.\\n\\nAfter the commit 2125c0034c5d (\\\"cgroup/cpuset: Make cpuset hotplug\\nprocessing synchronous\\\"), the cpuset_write_resmask no longer needs to\\nwait the hotplug to finish, which means that concurrent hotplug and cpuset\\noperations are no longer possible. Therefore, the deadlock doesn\u0027t exist\\nanymore and it does not have to \u0027break active protection\u0027 now. To fix this\\nwarning, just remove kernfs_break_active_protection operation in the\\n\u0027cpuset_write_resmask\u0027.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cgroup/cpuset: eliminar kernfs active break Se encontr\u00f3 una advertencia: ADVERTENCIA: CPU: 10 PID: 3486953 en fs/kernfs/file.c:828 CPU: 10 PID: 3486953 Comm: rmdir Kdump: cargado Tainted: G RIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0 RSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202 RAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000 RDX: 00000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04 RBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180 R10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08 R13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0 FS: 00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:00000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: GS:ffff8887ddc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Seguimiento de llamadas: kernfs_drain+0x15e/0x2f0 __kernfs_remove+0x165/0x300 kernfs_remove_by_name_ns+0x7b/0xc0 cgroup_rm_file+0x154/0x1c0 cgroup_addrm_files+0x1c2/0x1f0 css_clear_dir+0x77/0x110 kill_css+0x4c/0x1b0 cgroup_destroy_locked+0x194/0x380 cgroup_rmdir+0x2a/0x140 Se puede explicar por: rmdir echo 1 \u0026gt; cpuset.cpus kernfs_fop_write_iter // active=0 cgroup_rm_file kernfs_remove_by_name_ns kernfs_get_active // ??activo=1 __kernfs_remove // ??activo=0x80000002 kernfs_drain cpuset_write_resmask wait_event //esperando (activo == 0x80000001) kernfs_break_active_protection // activo = 0x80000001 // continuar kernfs_unbreak_active_protection // activo = 0x80000002 ... kernfs_should_drain_open_files // se produce una advertencia kernfs_put_active Esta advertencia es causada por \u0027kernfs_break_active_protection\u0027 cuando est\u00e1 escribiendo en cpuset.cpus y el cgroup se elimina simult\u00e1neamente. El commit 3a5a6d0c2b03 (\\\"cpuset: no anide cgroup_mutex dentro de get_online_cpus()\\\") hizo que cpuset_hotplug_workfn sea as\u00edncrono. Este cambio implica llamar a flush_work(), que puede crear una dependencia de bloqueo circular de m\u00faltiples procesos que involucran a cgroup_mutex, lo que puede llevar a un bloqueo. Para evitarlo, el commit 76bb5ab8f6e3 (\\\"cpuset: interrumpa la protecci\u00f3n activa de kernfs en cpuset_write_resmask()\\\") agreg\u00f3 \u0027kernfs_break_active_protection\u0027 en cpuset_write_resmask. Esto podr\u00eda llevar a esta advertencia. Despu\u00e9s de el commit 2125c0034c5d (\\\"cgroup/cpuset: haga que el procesamiento de hotplug de cpuset sea sincr\u00f3nico\\\"), cpuset_write_resmask ya no necesita esperar a que finalice el hotplug, lo que significa que las operaciones de hotplug y cpuset concurrentes ya no son posibles. Por lo tanto, el bloqueo ya no existe y ya no es necesario \\\"interrumpir la protecci\u00f3n activa\\\". Para solucionar esta advertencia, simplemente elimine la operaci\u00f3n kernfs_break_active_protection en \\\"cpuset_write_resmask\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.16\",\"versionEndExcluding\":\"6.12.10\",\"matchCriteriaId\":\"8F9CB506-FF99-4655-9CE3-3F7E0FEC94A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/11cb1d643a74665a4e14749414f48f82cbc15c64\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3cb97a927fffe443e1e7e8eddbfebfdb062e86ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21634\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:54:20.155595Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-667\", \"description\": \"CWE-667 Improper Locking\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:55:07.442Z\"}}], \"cna\": {\"title\": \"cgroup/cpuset: remove kernfs active break\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"76bb5ab8f6e3e7bebdcefec4146ff305e7d0b465\", \"lessThan\": \"11cb1d643a74665a4e14749414f48f82cbc15c64\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"76bb5ab8f6e3e7bebdcefec4146ff305e7d0b465\", \"lessThan\": \"3cb97a927fffe443e1e7e8eddbfebfdb062e86ed\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/cgroup/cpuset.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/cgroup/cpuset.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/11cb1d643a74665a4e14749414f48f82cbc15c64\"}, {\"url\": \"https://git.kernel.org/stable/c/3cb97a927fffe443e1e7e8eddbfebfdb062e86ed\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncgroup/cpuset: remove kernfs active break\\n\\nA warning was found:\\n\\nWARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828\\nCPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G\\nRIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0\\nRSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202\\nRAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000\\nRDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04\\nRBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180\\nR10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08\\nR13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0\\nFS:  00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n kernfs_drain+0x15e/0x2f0\\n __kernfs_remove+0x165/0x300\\n kernfs_remove_by_name_ns+0x7b/0xc0\\n cgroup_rm_file+0x154/0x1c0\\n cgroup_addrm_files+0x1c2/0x1f0\\n css_clear_dir+0x77/0x110\\n kill_css+0x4c/0x1b0\\n cgroup_destroy_locked+0x194/0x380\\n cgroup_rmdir+0x2a/0x140\\n\\nIt can be explained by:\\nrmdir \\t\\t\\t\\techo 1 \u003e cpuset.cpus\\n\\t\\t\\t\\tkernfs_fop_write_iter // active=0\\ncgroup_rm_file\\nkernfs_remove_by_name_ns\\tkernfs_get_active // active=1\\n__kernfs_remove\\t\\t\\t\\t\\t  // active=0x80000002\\nkernfs_drain\\t\\t\\tcpuset_write_resmask\\nwait_event\\n//waiting (active == 0x80000001)\\n\\t\\t\\t\\tkernfs_break_active_protection\\n\\t\\t\\t\\t// active = 0x80000001\\n// continue\\n\\t\\t\\t\\tkernfs_unbreak_active_protection\\n\\t\\t\\t\\t// active = 0x80000002\\n...\\nkernfs_should_drain_open_files\\n// warning occurs\\n\\t\\t\\t\\tkernfs_put_active\\n\\nThis warning is caused by \u0027kernfs_break_active_protection\u0027 when it is\\nwriting to cpuset.cpus, and the cgroup is removed concurrently.\\n\\nThe commit 3a5a6d0c2b03 (\\\"cpuset: don\u0027t nest cgroup_mutex inside\\nget_online_cpus()\\\") made cpuset_hotplug_workfn asynchronous, This change\\ninvolves calling flush_work(), which can create a multiple processes\\ncircular locking dependency that involve cgroup_mutex, potentially leading\\nto a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 (\\\"cpuset: break\\nkernfs active protection in cpuset_write_resmask()\\\") added\\n\u0027kernfs_break_active_protection\u0027 in the cpuset_write_resmask. This could\\nlead to this warning.\\n\\nAfter the commit 2125c0034c5d (\\\"cgroup/cpuset: Make cpuset hotplug\\nprocessing synchronous\\\"), the cpuset_write_resmask no longer needs to\\nwait the hotplug to finish, which means that concurrent hotplug and cpuset\\noperations are no longer possible. Therefore, the deadlock doesn\u0027t exist\\nanymore and it does not have to \u0027break active protection\u0027 now. To fix this\\nwarning, just remove kernfs_break_active_protection operation in the\\n\u0027cpuset_write_resmask\u0027.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.10\", \"versionStartIncluding\": \"3.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"3.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T07:17:55.268Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21634\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-01T19:57:18.437Z\", \"dateReserved\": \"2024-12-29T08:45:45.726Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-19T10:17:52.983Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.