Critical Synchronization Issue in Linux Kernel's ibmveth Package Leading to System Hang
Summary
CVE-2025-22053: In the Linux kernel, the following vulnerability has been resolved: net: ibmveth: make veth_pool_store stop hanging v2: - Created a single error handling unlock and exit in veth_pool_store - Greatly expanded commit messa... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The ibmveth package is a virtual Ethernet driver for IBM systems, enabling network communication. This package is crucial for maintaining network connectivity in virtualized environments. However, it has been found to have a vulnerability that can lead to system hangs when multiple threads access the veth_pool_store function simultaneously.
Vulnerability Detail
The vulnerability, identified as CVE-2025-22053, arises from improper synchronization in the veth_pool_store function of the ibmveth driver. When two or more threads attempt to modify the network pool settings concurrently, it can lead to a deadlock situation, causing the system to hang indefinitely. This issue is exacerbated when users interact with the /sys/devices/vio/30000002/pool* files, which can be easily scripted, leading to potential denial of service. The vulnerability was resolved by implementing proper locking mechanisms using rtnl_mutex to prevent concurrent access.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid writing to the /sys/devices/vio/30000002/pool* files from multiple threads or scripts simultaneously. This can be managed by implementing a locking mechanism in the scripts that access these files, ensuring that only one thread can modify the settings at a time.
Conclusion
CVE-2025-22053 is a critical vulnerability in the Linux kernel's ibmveth driver that can lead to system hangs due to improper synchronization. Users are advised to update their kernel to the latest version to mitigate this issue. Additionally, temporary workarounds can be implemented to avoid concurrent access to the affected functions.
See every vulnerability recorded for linux →
FAQ
CVE-2025-22053 is a vulnerability in the Linux kernel's ibmveth driver that can cause system hangs due to improper synchronization when multiple threads access the veth_pool_store function.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply uploading your manifest file, you can check for vulnerabilities without needing to install any software.
The main consequence is a potential denial of service, where the system may become unresponsive due to threads being blocked indefinitely while trying to access the veth_pool_store function.
Yes, a patch has been released in the latest versions of the Linux kernel. Users should update their kernel to the patched version to mitigate the vulnerability.
Yes, you can use the Vulert playground to check if your application is affected by this vulnerability without any signup required.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
