CVE-2025-21801

Source
https://cve.org/CVERecord?id=CVE-2025-21801
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21801.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-21801
Downstream
Related
Published
2025-02-27T20:00:55.572Z
Modified
2026-03-11T05:36:08.833176Z
Summary
net: ravb: Fix missing rtnl lock in suspend/resume path
Details

In the Linux kernel, the following vulnerability has been resolved:

net: ravb: Fix missing rtnl lock in suspend/resume path

Fix the suspend/resume path by ensuring the rtnl lock is held where required. Calls to ravbopen, ravbclose and wol operations must be performed under the rtnl lock to prevent conflicts with ongoing ndo operations.

Without this fix, the following warning is triggered: [ 39.032969] ============================= [ 39.032983] WARNING: suspicious RCU usage [ 39.033019] ----------------------------- [ 39.033033] drivers/net/phy/phydevice.c:2004 suspicious rcudereferenceprotected() usage! ... [ 39.033597] stack backtrace: [ 39.033613] CPU: 0 UID: 0 PID: 174 Comm: python3 Not tainted 6.13.0-rc7-next-20250116-arm64-renesas-00002-g35245dfdc62c #7 [ 39.033623] Hardware name: Renesas SMARC EVK version 2 based on r9a08g045s33 (DT) [ 39.033628] Call trace: [ 39.033633] showstack+0x14/0x1c (C) [ 39.033652] dumpstacklvl+0xb4/0xc4 [ 39.033664] dumpstack+0x14/0x1c [ 39.033671] lockdeprcususpicious+0x16c/0x22c [ 39.033682] phydetach+0x160/0x190 [ 39.033694] phydisconnect+0x40/0x54 [ 39.033703] ravbclose+0x6c/0x1cc [ 39.033714] ravbsuspend+0x48/0x120 [ 39.033721] dpmruncallback+0x4c/0x14c [ 39.033731] devicesuspend+0x11c/0x4dc [ 39.033740] dpmsuspend+0xdc/0x214 [ 39.033748] dpmsuspendstart+0x48/0x60 [ 39.033758] suspenddevicesandenter+0x124/0x574 [ 39.033769] pmsuspend+0x1ac/0x274 [ 39.033778] statestore+0x88/0x124 [ 39.033788] kobjattrstore+0x14/0x24 [ 39.033798] sysfskfwrite+0x48/0x6c [ 39.033808] kernfsfopwriteiter+0x118/0x1a8 [ 39.033817] vfswrite+0x27c/0x378 [ 39.033825] ksys_write+0x64/0xf4 [ 39.033833] _arm64syswrite+0x18/0x20 [ 39.033841] invokesyscall+0x44/0x104 [ 39.033852] el0svccommon.constprop.0+0xb4/0xd4 [ 39.033862] doel0svc+0x18/0x20 [ 39.033870] el0svc+0x3c/0xf0 [ 39.033880] el0t64synchandler+0xc0/0xc4 [ 39.033888] el0t64sync+0x154/0x158 [ 39.041274] ravb 11c30000.ethernet eth0: Link is Down

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21801.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0184165b2f42c4b032da9dd11546bfbaeb5afd4e
Fixed
0296981941cf291edfbc318d3255a93439f368e4
Fixed
ad19522c007bb24ed874468f8baa1503c4662cf4
Fixed
2c2ebb2b49573e5f8726112ad06b1dffc3c9ea03

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21801.json"