CVE-2025-21701

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-21701
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21701.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-21701
Downstream
Related
Published
2025-02-13T15:05:46.483Z
Modified
2026-03-12T02:17:30.451732Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
net: avoid race between device unregistration and ethnl ops
Details

In the Linux kernel, the following vulnerability has been resolved:

net: avoid race between device unregistration and ethnl ops

The following trace can be seen if a device is being unregistered while its number of channels are being modified.

DEBUGLOCKSWARN_ON(lock->magic != lock) WARNING: CPU: 3 PID: 3754 at kernel/locking/mutex.c:564 __mutex_lock+0xc8a/0x1120 CPU: 3 UID: 0 PID: 3754 Comm: ethtool Not tainted 6.13.0-rc6+ #771 RIP: 0010:__mutexlock+0xc8a/0x1120 Call Trace: <TASK> ethtoolcheckmaxchannel+0x1ea/0x880 ethnlsetchannels+0x3c3/0xb10 ethnldefaultsetdoit+0x306/0x650 genlfamilyrcvmsgdoit+0x1e3/0x2c0 genlrcvmsg+0x432/0x6f0 netlinkrcvskb+0x13d/0x3b0 genlrcv+0x28/0x40 netlinkunicast+0x42e/0x720 netlinksendmsg+0x765/0xc20 __sys_sendto+0x3ac/0x420 __x64syssendto+0xe0/0x1c0 dosyscall64+0x95/0x180 entrySYSCALL64afterhwframe+0x76/0x7e

This is because unregisternetdevicemanynotify might run before the rtnl lock section of ethnl operations, eg. setchannels in the above example. In this example the rss lock would be destroyed by the device unregistration path before being used again, but in general running ethnl operations while dismantle has started is not a good idea.

Fix this by denying any operation on devices being unregistered. A check was already there in ethnlopsbegin, but not wide enough.

Note that the same issue cannot be seen on the ioctl version (_devethtool) because the device reference is retrieved from within the rtnl lock section there. Once dismantle started, the net device is unlisted and no reference will be found.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21701.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
cfd719f04267108f5f5bf802b9d7de69e99a99f9
Fixed
26bc6076798aa4dc83a07d0a386f9e57c94e8517
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
dde91ccfa25fd58f64c397d91b81a4b393100ffa
Fixed
b1cb37a31a482df3dd35a6ac166282dac47664f4
Fixed
2f29127e94ae9fdc7497331003d6860e9551cdf3
Fixed
b382ab9b885cbb665e0e70a727f101c981b4edf3
Fixed
4dc880245f9b529fa8f476b5553c799d2848b47b
Fixed
12e070eb6964b341b41677fd260af5a305316a1f
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7c26da3be1e9843a15b5318f90db8a564479d2ac

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21701.json"