Deadlock Vulnerability in Linux Kernel: PCI Generic Recovery Issue
Summary
CVE-2025-21951: In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock There are multiple places from where the recovery work gets scheduled asynch... Affects linux versions < 6.1.133-1. Fixed in 6.1.133-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and support for a wide range of hardware. However, it is also susceptible to vulnerabilities that can affect system reliability and security. This specific vulnerability relates to the PCI Generic subsystem, which is responsible for managing PCI devices and their interactions with the kernel.
Vulnerability Detail
In the Linux kernel, a deadlock vulnerability has been identified in the PCI Generic subsystem, specifically within the MHI host driver. The issue arises during the recovery process of a device that has become unresponsive. When the recovery work is scheduled asynchronously, it can lead to a situation where the device is attempted to be reset while another process holds the device lock. This can result in a deadlock, preventing the system from recovering the device and potentially leading to system instability. The vulnerability has been observed in the X1E80100 CRD device, particularly during the PM shutdown and suspend callbacks.
How To Fix
Minimum fixed version
6.1.133-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. However, users are advised to monitor their systems and apply the patch as soon as it becomes available.
Conclusion
The CVE-2025-21951 vulnerability in the Linux kernel poses a significant risk of deadlock during device recovery processes. It is crucial for users to update their systems to the patched version to mitigate this risk. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21951 is a vulnerability in the Linux kernel related to the PCI Generic subsystem that can lead to a deadlock during device recovery.
If your system uses affected versions of the Linux kernel, it may experience deadlocks during device recovery, leading to system instability.
Yes, a patch is available for Debian 13 in version 6.12.19-1. Debian 12 is still awaiting a patch.
While there are no specific workarounds, it is important to monitor your system for any signs of instability and apply the patch as soon as possible.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
