Critical Locking Dependency Vulnerability in Linux Kernel - CVE-2025-21812
Summary
CVE-2025-21812: In the Linux kernel, the following vulnerability has been resolved: ax25: rcu protect dev->ax25_ptr syzbot found a lockdep issue [1]. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its stability, performance, and security features. However, it is also susceptible to vulnerabilities that can compromise system integrity. CVE-2025-21812 specifically affects the ax25 protocol implementation within the kernel, which is used for AX.25 packet radio networking.
Vulnerability Detail
CVE-2025-21812 is a critical vulnerability found in the Linux kernel's ax25 implementation. It arises from a circular locking dependency between the sk_lock and rtnl_mutex locks during the execution of the ax25_setsockopt function. This can lead to a potential deadlock situation, where two processes are unable to proceed because each is waiting for the other to release a lock. The vulnerability was identified by syzbot, which reported a lockdep issue indicating that the ax25 RTNL dependency should be removed to mitigate the risk of use-after-free (UAF) scenarios.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the ax25 protocol until a patch is applied. This may involve disabling any services or applications that rely on ax25 functionality.
Conclusion
CVE-2025-21812 is a significant vulnerability in the Linux kernel's ax25 implementation that poses risks of deadlocks and system instability. Users are advised to update their systems to patched versions of the kernel to mitigate these risks. Temporary workarounds are available, but applying the patch is the best course of action.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21812 is a vulnerability in the Linux kernel's ax25 protocol that can lead to deadlocks due to circular locking dependencies.
If exploited, this vulnerability can cause system instability and may lead to denial of service due to deadlocks.
The vulnerability affects multiple versions of the Linux kernel across Debian 11, 12, and 13.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, a patch is available in the updated versions of the Linux kernel. It is recommended to update your system to the latest kernel version.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
