Recursive Locking Vulnerability in Linux Kernel: CVE-2025-21986
Summary
CVE-2025-21986: In the Linux kernel, the following vulnerability has been resolved: net: switchdev: Convert blocking notification chain to a raw one A blocking notification chain uses a read-write semaphore to protect the integrity of t... Affects linux versions < 6.1.133-1. Fixed in 6.1.133-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services to software applications and ensures efficient operation. The kernel is modular, allowing for various functionalities, including networking, file systems, and device management. This vulnerability specifically affects the switchdev notification chain, which is responsible for handling events related to network switches.
Vulnerability Detail
CVE-2025-21986 is a vulnerability in the Linux kernel's switchdev notification chain that allows for recursive notifications, leading to potential deadlocks. The issue arises from the use of a read-write semaphore to manage access to the notification chain. When the bridge driver processes a SWITCHDEV_BRPORT_UNOFFLOADED event, it can trigger recursive notifications, causing the semaphore to be acquired multiple times for reading. This can result in lockdep warnings and possible deadlocks, compromising system stability and performance.
How To Fix
Minimum fixed version
6.1.133-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
CVE-2025-21986 is a significant vulnerability in the Linux kernel that can lead to system instability due to recursive locking issues in the switchdev notification chain. It is essential to apply the available patch to mitigate risks and ensure system reliability.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21986 is a vulnerability in the Linux kernel that allows for recursive notifications in the switchdev notification chain, potentially leading to deadlocks.
This vulnerability can compromise system stability and performance by causing deadlocks during network switch event processing.
Yes, a patch is available for Debian 13 in version 6.12.20-1. Users of Debian 12 should check for updates as the urgency has not yet been assigned.
While there are no specific workarounds, it is crucial to monitor the situation and apply the patch as soon as it becomes available.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
