PT-2025-14323 · Linux+1 · Linux Kernel+1

Anubis · Published 2025-02-19 · Updated 2025-04-02 · CVE-2025-21942

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.13.0

Description A vulnerability in the Linux kernel has been resolved, specifically in the btrfs zoned mode. The issue occurs when there is no active zone available, causing the btrfs reserve extent() function to return -EAGAIN. This leads to a hang issue due to a failure to unlock allocated extents. The problem arises from a commit that moved the unlock code outside a loop, causing the allocated extents to remain locked in certain cases. The vulnerability can cause tasks to become blocked for an extended period, resulting in a system hang.

Recommendations To resolve the issue, update to a Linux kernel version that includes the fix for the extent range end unlock in cow file range(). As a temporary workaround, consider disabling the btrfs module or restricting its use until a patched version is available. Additionally, avoid using the btrfs filesystem in zoned mode until the issue is resolved.

Exploit

Fix

Infinite Loop

Improper Locking

Weakness Enumeration

CWE-835

CWE-667

Related Identifiers

BDU:2025-04623

CVE-2025-21942

Affected Products

Astra Linux

Linux Kernel

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21942.json · Exploit
• https://bdu.fstec.ru/vul/2025-04623 · Security Note
• https://git.kernel.org/stable/c/5a4041f2c47247575a6c2e53ce14f7b0ac946c33 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-21942 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-20551.html · Vendor Advisory
• https://git.kernel.org/stable/c/3fcff2f55389306482ab049b4321bda49495e546 · Patch
• https://ubuntu.com/security/CVE-2025-21942 · Vendor Advisory
• https://git.kernel.org/stable/c/5f4863cfb29a7b4fe7625ce148d0b9000b75b802 · Patch
• https://osv.dev/vulnerability/CVE-2025-21942 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-21942 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-21942 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-21942 · Vendor Advisory
• https://twitter.com/CVEnew/status/1907339874375467091 · Twitter Post
• https://lore.kernel.org/linux-cve-announce/2025040135-CVE-2025-21942-2957@gregkh · Note
• https://access.redhat.com/security/cve/CVE-2025-21942 · Note