CVE-2025-22111

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.

SIOCBRDELIF is passed to dev_ioctl() first and later forwarded to

br_ioctl_call(), which causes unnecessary RTNL dance and the splat

below [0] under RTNL pressure.

Let's say Thread A is trying to detach a device from a bridge and

Thread B is trying to remove the bridge.

In dev_ioctl(), Thread A bumps the bridge device's refcnt by

netdev_hold() and releases RTNL because the following br_ioctl_call()

also re-acquires RTNL.

In the race window, Thread B could acquire RTNL and try to remove

the bridge device. Then, rtnl_unlock() by Thread B will release RTNL

and wait for netdev_put() by Thread A.

Thread A, however, must hold RTNL after the unlock in dev_ifsioc(),

which may take long under RTNL pressure, resulting in the splat by

Thread B.

Thread A (SIOCBRDELIF) Thread B (SIOCBRDELBR)

---------------------- ----------------------

sock_i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References