CVE-2025-21820

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
27/02/2025
Last modified:
13/03/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tty: xilinx_uartps: split sysrq handling<br /> <br /> lockdep detects the following circular locking dependency:<br /> <br /> CPU 0 CPU 1<br /> ========================== ============================<br /> cdns_uart_isr() printk()<br /> uart_port_lock(port) console_lock()<br /> cdns_uart_console_write()<br /> if (!port-&gt;sysrq)<br /> uart_port_lock(port)<br /> uart_handle_break()<br /> port-&gt;sysrq = ...<br /> uart_handle_sysrq_char()<br /> printk()<br /> console_lock()<br /> <br /> The fixed commit attempts to avoid this situation by only taking the<br /> port lock in cdns_uart_console_write if port-&gt;sysrq unset. However, if<br /> (as shown above) cdns_uart_console_write runs before port-&gt;sysrq is set,<br /> then it will try to take the port lock anyway. This may result in a<br /> deadlock.<br /> <br /> Fix this by splitting sysrq handling into two parts. We use the prepare<br /> helper under the port lock and defer handling until we release the lock.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.6 (including) 6.1.129 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.78 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.12.14 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.13 (including) 6.13.3 (excluding)