CVE-2025-21809

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc, afs: Fix peer hash locking vs RCU callback

In its address list, afs now retains pointers to and refs on one or more

rxrpc_peer objects. The address list is freed under RCU and at this time,

it puts the refs on those peers.

Now, when an rxrpc_peer object runs out of refs, it gets removed from the

peer hash table and, for that, rxrpc has to take a spinlock. However, it

is now being called from afs's RCU cleanup, which takes place in BH

context - but it is just taking an ordinary spinlock.

The put may also be called from non-BH context, and so there exists the

possibility of deadlock if the BH-based RCU cleanup happens whilst the hash

spinlock is held. This led to the attached lockdep complaint.

Fix this by changing spinlocks of rxnet->peer_hash_lock back to

BH-disabling locks.

================================

WARNING: inconsistent lock state

6.13.0-rc5-build2+ #1223 Tainted: G E

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References