In the Linux kernel, the following vulnerability has been resolved:
net: ibmveth: make vethpoolstore stop hanging
v2: - Created a single error handling unlock and exit in vethpoolstore - Greatly expanded commit message with previous explanatory-only text
Summary: Use rtnlmutex to synchronize vethpoolstore with itself, ibmvethclose and ibmvethopen, preventing multiple calls in a row to napidisable.
Background: Two (or more) threads could call vethpoolstore through writing to /sys/devices/vio/30000002/pool/. You can do this easily with a little shell script. This causes a hang.
I configured LOCKDEP, compiled ibmveth.c with DEBUG, and built a new kernel. I ran this test again and saw:
Setting pool0/active to 0
Setting pool1/active to 1
[ 73.911067][ T4365] ibmveth 30000002 eth0: close starting
Setting pool1/active to 1
Setting pool1/active to 0
[ 73.911367][ T4366] ibmveth 30000002 eth0: close starting
[ 73.916056][ T4365] ibmveth 30000002 eth0: close complete
[ 73.916064][ T4365] ibmveth 30000002 eth0: open starting
[ 110.808564][ T712] systemd-journald[712]: Sent WATCHDOG=1 notification.
[ 230.808495][ T712] systemd-journald[712]: Sent WATCHDOG=1 notification.
[ 243.683786][ T123] INFO: task stress.sh:4365 blocked for more than 122 seconds.
[ 243.683827][ T123] Not tainted 6.14.0-01103-g2df0c02dab82-dirty #8
[ 243.683833][ T123] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 243.683838][ T123] task:stress.sh state:D stack:28096 pid:4365 tgid:4365 ppid:4364 task_flags:0x400040 flags:0x00042000
[ 243.683852][ T123] Call Trace:
[ 243.683857][ T123] [c00000000c38f690] [0000000000000001] 0x1 (unreliable)
[ 243.683868][ T123] [c00000000c38f840] [c00000000001f908] __switch_to+0x318/0x4e0
[ 243.683878][ T123] [c00000000c38f8a0] [c000000001549a70] __schedule+0x500/0x12a0
[ 243.683888][ T123] [c00000000c38f9a0] [c00000000154a878] schedule+0x68/0x210
[ 243.683896][ T123] [c00000000c38f9d0] [c00000000154ac80] schedule_preempt_disabled+0x30/0x50
[ 243.683904][ T123] [c00000000c38fa00] [c00000000154dbb0] __mutex_lock+0x730/0x10f0
[ 243.683913][ T123] [c00000000c38fb10] [c000000001154d40] napi_enable+0x30/0x60
[ 243.683921][ T123] [c00000000c38fb40] [c000000000f4ae94] ibmveth_open+0x68/0x5dc
[ 243.683928][ T123] [c00000000c38fbe0] [c000000000f4aa20] veth_pool_store+0x220/0x270
[ 243.683936][ T123] [c00000000c38fc70] [c000000000826278] sysfs_kf_write+0x68/0xb0
[ 243.683944][ T123] [c00000000c38fcb0] [c0000000008240b8] kernfs_fop_write_iter+0x198/0x2d0
[ 243.683951][ T123] [c00000000c38fd00] [c00000000071b9ac] vfs_write+0x34c/0x650
[ 243.683958][ T123] [c00000000c38fdc0] [c00000000071bea8] ksys_write+0x88/0x150
[ 243.683966][ T123] [c00000000c38fe10] [c0000000000317f4] system_call_exception+0x124/0x340
[ 243.683973][ T123] [c00000000c38fe50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec
...
[ 243.684087][ T123] Showing all locks held in the system:
[ 243.684095][ T123] 1 lock held by khungtaskd/123:
[ 243.684099][ T123] #0: c00000000278e370 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x50/0x248
[ 243.684114][ T123] 4 locks held by stress.sh/4365:
[ 243.684119][ T123] #0: c00000003a4cd3f8 (sb_writers#3){.+.+}-{0:0}, at: ksys_write+0x88/0x150
[ 243.684132][ T123] #1: c000000041aea888 (&of->mutex#2){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x154/0x2d0
[ 243.684143][ T123] #2: c0000000366fb9a8 (kn->active#64){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x160/0x2d0
[ 243.684155][ T123] #3: c000000035ff4cb8 (&dev->lock){+.+.}-{3:3}, at: napi_enable+0x30/0x60
[ 243.684166][ T123] 5 locks held by stress.sh/4366:
[ 243.684170][ T123] #0: c00000003a4cd3f8 (sb_writers#3){.+.+}-{0:0}, at: ksys_write+0x88/0x150
[ 243.
---truncated---
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@053f3ff67d7feefc75797863f3d84b47ad47086f",
"signature_type": "Function",
"id": "CVE-2025-22053-020ad207",
"target": {
"file": "drivers/net/ethernet/ibm/ibmveth.c",
"function": "veth_pool_store"
},
"deprecated": false,
"digest": {
"function_hash": "237150551531975505190989175570032646722",
"length": 1820.0
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@053f3ff67d7feefc75797863f3d84b47ad47086f",
"signature_type": "Line",
"id": "CVE-2025-22053-02a66c88",
"target": {
"file": "drivers/net/ethernet/ibm/ibmveth.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"239482966200737621524712886392921483121",
"44881197069750104275284327678320879128",
"75699042866572209838927299950237818518",
"83243973186230040283343454069701484465",
"215582106095558168922025906941434210327",
"66544325934751144338353998702904568892",
"103522944054448993205541659282821764629",
"323373232552454014489472044466775891797",
"198093327303814075476342845742393782919",
"176569215349768501930329211964878596027",
"62972225685791813181418976509964039923",
"84140540927112028446735473168331327057",
"292555543057031169412773097290024309170",
"74670137213070945268374854957280701910",
"110640452836465786750636159812655503568",
"175338372389587352321315710687624551742",
"168956671157539385307161107899778986360",
"269151637464580657319915456854647257993",
"205137079895164767812404037950335740590",
"147456604799367859256192382249156295994",
"312844862096804696920575871345112204755",
"303431726411850523197317617355246666407",
"76065372308204110090694758613311010982",
"204224400525957645257683697709379534516",
"275224340308104501766826041872531305701",
"54822969135407095794880265069579288217",
"19010837555195760767531223010011541887",
"190997653662038036894165435603602700508",
"10538400985108880961355711903832308018",
"339927813494653995611945552715637439685",
"266053049095607923946718571557478843045",
"239145086871948174349015275324086881722",
"260760345868544087369114953446813209204",
"111182645394185092695288213379408277910",
"131782319782231972727622608915393130584",
"240669602823098882737195162073917985946",
"188099113082762612055381507741947467147",
"129843531061060157528679732497984685840",
"157121904596546708999546845864938208164",
"286154679367911248445345141441568193131",
"65100295742669875487175954242347726224",
"308594385042429244466290943270672849725",
"230895006640280670055513025050497609107",
"266053049095607923946718571557478843045",
"173351176164768088990918286203039744339",
"315851819670472997741121562682352724949",
"174475602344164776766129121408921506106",
"18583128968571371085001413905245295113",
"218528951119250313038086056720823361626",
"283151395478746590278630234825944738807",
"276131191189679862290770343371747444380",
"338426556520740053075465046741203951689",
"284402109040387480630133529557134977117",
"304185269792286851712669537757811334998",
"261239199187327709519724215745942637932",
"181590114533608289450548926470594940602",
"241316675417796694674281957908729145059"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a88bb092f4208355880b9fdcc69d491aa297595",
"signature_type": "Function",
"id": "CVE-2025-22053-0915928d",
"target": {
"file": "drivers/net/ethernet/ibm/ibmveth.c",
"function": "veth_pool_store"
},
"deprecated": false,
"digest": {
"function_hash": "237150551531975505190989175570032646722",
"length": 1820.0
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86cc70f5c85dc09bf7f3e1eee380eefe73c90765",
"signature_type": "Line",
"id": "CVE-2025-22053-505ae4f4",
"target": {
"file": "drivers/net/ethernet/ibm/ibmveth.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"239482966200737621524712886392921483121",
"44881197069750104275284327678320879128",
"75699042866572209838927299950237818518",
"83243973186230040283343454069701484465",
"215582106095558168922025906941434210327",
"66544325934751144338353998702904568892",
"103522944054448993205541659282821764629",
"323373232552454014489472044466775891797",
"198093327303814075476342845742393782919",
"176569215349768501930329211964878596027",
"62972225685791813181418976509964039923",
"84140540927112028446735473168331327057",
"292555543057031169412773097290024309170",
"74670137213070945268374854957280701910",
"110640452836465786750636159812655503568",
"175338372389587352321315710687624551742",
"168956671157539385307161107899778986360",
"269151637464580657319915456854647257993",
"205137079895164767812404037950335740590",
"147456604799367859256192382249156295994",
"312844862096804696920575871345112204755",
"303431726411850523197317617355246666407",
"76065372308204110090694758613311010982",
"204224400525957645257683697709379534516",
"275224340308104501766826041872531305701",
"54822969135407095794880265069579288217",
"19010837555195760767531223010011541887",
"190997653662038036894165435603602700508",
"10538400985108880961355711903832308018",
"339927813494653995611945552715637439685",
"266053049095607923946718571557478843045",
"239145086871948174349015275324086881722",
"260760345868544087369114953446813209204",
"111182645394185092695288213379408277910",
"131782319782231972727622608915393130584",
"240669602823098882737195162073917985946",
"188099113082762612055381507741947467147",
"129843531061060157528679732497984685840",
"157121904596546708999546845864938208164",
"286154679367911248445345141441568193131",
"65100295742669875487175954242347726224",
"308594385042429244466290943270672849725",
"230895006640280670055513025050497609107",
"266053049095607923946718571557478843045",
"173351176164768088990918286203039744339",
"315851819670472997741121562682352724949",
"174475602344164776766129121408921506106",
"18583128968571371085001413905245295113",
"218528951119250313038086056720823361626",
"283151395478746590278630234825944738807",
"276131191189679862290770343371747444380",
"338426556520740053075465046741203951689",
"284402109040387480630133529557134977117",
"304185269792286851712669537757811334998",
"261239199187327709519724215745942637932",
"181590114533608289450548926470594940602",
"241316675417796694674281957908729145059"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a2470e3ecde64fc7e3781dc474923193621ae67",
"signature_type": "Function",
"id": "CVE-2025-22053-6c6ba7ef",
"target": {
"file": "drivers/net/ethernet/ibm/ibmveth.c",
"function": "veth_pool_store"
},
"deprecated": false,
"digest": {
"function_hash": "237150551531975505190989175570032646722",
"length": 1820.0
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a88bb092f4208355880b9fdcc69d491aa297595",
"signature_type": "Line",
"id": "CVE-2025-22053-81fca721",
"target": {
"file": "drivers/net/ethernet/ibm/ibmveth.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"239482966200737621524712886392921483121",
"44881197069750104275284327678320879128",
"75699042866572209838927299950237818518",
"83243973186230040283343454069701484465",
"215582106095558168922025906941434210327",
"66544325934751144338353998702904568892",
"103522944054448993205541659282821764629",
"323373232552454014489472044466775891797",
"198093327303814075476342845742393782919",
"176569215349768501930329211964878596027",
"62972225685791813181418976509964039923",
"84140540927112028446735473168331327057",
"292555543057031169412773097290024309170",
"74670137213070945268374854957280701910",
"110640452836465786750636159812655503568",
"175338372389587352321315710687624551742",
"168956671157539385307161107899778986360",
"269151637464580657319915456854647257993",
"205137079895164767812404037950335740590",
"147456604799367859256192382249156295994",
"312844862096804696920575871345112204755",
"303431726411850523197317617355246666407",
"76065372308204110090694758613311010982",
"204224400525957645257683697709379534516",
"275224340308104501766826041872531305701",
"54822969135407095794880265069579288217",
"19010837555195760767531223010011541887",
"190997653662038036894165435603602700508",
"10538400985108880961355711903832308018",
"339927813494653995611945552715637439685",
"266053049095607923946718571557478843045",
"239145086871948174349015275324086881722",
"260760345868544087369114953446813209204",
"111182645394185092695288213379408277910",
"131782319782231972727622608915393130584",
"240669602823098882737195162073917985946",
"188099113082762612055381507741947467147",
"129843531061060157528679732497984685840",
"157121904596546708999546845864938208164",
"286154679367911248445345141441568193131",
"65100295742669875487175954242347726224",
"308594385042429244466290943270672849725",
"230895006640280670055513025050497609107",
"266053049095607923946718571557478843045",
"173351176164768088990918286203039744339",
"315851819670472997741121562682352724949",
"174475602344164776766129121408921506106",
"18583128968571371085001413905245295113",
"218528951119250313038086056720823361626",
"283151395478746590278630234825944738807",
"276131191189679862290770343371747444380",
"338426556520740053075465046741203951689",
"284402109040387480630133529557134977117",
"304185269792286851712669537757811334998",
"261239199187327709519724215745942637932",
"181590114533608289450548926470594940602",
"241316675417796694674281957908729145059"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a2470e3ecde64fc7e3781dc474923193621ae67",
"signature_type": "Line",
"id": "CVE-2025-22053-acfbad8a",
"target": {
"file": "drivers/net/ethernet/ibm/ibmveth.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"239482966200737621524712886392921483121",
"44881197069750104275284327678320879128",
"75699042866572209838927299950237818518",
"83243973186230040283343454069701484465",
"215582106095558168922025906941434210327",
"66544325934751144338353998702904568892",
"103522944054448993205541659282821764629",
"323373232552454014489472044466775891797",
"198093327303814075476342845742393782919",
"176569215349768501930329211964878596027",
"62972225685791813181418976509964039923",
"84140540927112028446735473168331327057",
"292555543057031169412773097290024309170",
"74670137213070945268374854957280701910",
"110640452836465786750636159812655503568",
"175338372389587352321315710687624551742",
"168956671157539385307161107899778986360",
"269151637464580657319915456854647257993",
"205137079895164767812404037950335740590",
"147456604799367859256192382249156295994",
"312844862096804696920575871345112204755",
"303431726411850523197317617355246666407",
"76065372308204110090694758613311010982",
"204224400525957645257683697709379534516",
"275224340308104501766826041872531305701",
"54822969135407095794880265069579288217",
"19010837555195760767531223010011541887",
"190997653662038036894165435603602700508",
"10538400985108880961355711903832308018",
"339927813494653995611945552715637439685",
"266053049095607923946718571557478843045",
"239145086871948174349015275324086881722",
"260760345868544087369114953446813209204",
"111182645394185092695288213379408277910",
"131782319782231972727622608915393130584",
"240669602823098882737195162073917985946",
"188099113082762612055381507741947467147",
"129843531061060157528679732497984685840",
"157121904596546708999546845864938208164",
"286154679367911248445345141441568193131",
"65100295742669875487175954242347726224",
"308594385042429244466290943270672849725",
"230895006640280670055513025050497609107",
"266053049095607923946718571557478843045",
"173351176164768088990918286203039744339",
"315851819670472997741121562682352724949",
"174475602344164776766129121408921506106",
"18583128968571371085001413905245295113",
"218528951119250313038086056720823361626",
"283151395478746590278630234825944738807",
"276131191189679862290770343371747444380",
"338426556520740053075465046741203951689",
"284402109040387480630133529557134977117",
"304185269792286851712669537757811334998",
"261239199187327709519724215745942637932",
"181590114533608289450548926470594940602",
"241316675417796694674281957908729145059"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86cc70f5c85dc09bf7f3e1eee380eefe73c90765",
"signature_type": "Function",
"id": "CVE-2025-22053-e822d575",
"target": {
"file": "drivers/net/ethernet/ibm/ibmveth.c",
"function": "veth_pool_store"
},
"deprecated": false,
"digest": {
"function_hash": "237150551531975505190989175570032646722",
"length": 1820.0
},
"signature_version": "v1"
}
]