PT-2025-4338 · Linux · Linux Kernel

Published 2025-01-08 · Updated 2025-10-15 · CVE-2025-21657

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the sched ext component in the Linux kernel, where the function scx ops bypass() iterates over all CPUs to re-enqueue scx tasks. It acquires a lock using rq lock() regardless of whether a CPU is offline or running a task in a higher scheduler class. This may trigger an unnecessary warning in rq pin lock(). The fix involves replacing rq lock() with raw spin rq lock() in scx ops bypass(). Without this change, a warning is observed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-413

Related Identifiers

BDU:2026-04065

CVE-2025-21657

Affected Products

Linux Kernel

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21657.json · Exploit
• https://osv.dev/vulnerability/BELL-CVE-2025-21657 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-21657 · Security Note
• https://git.kernel.org/stable/c/d9e446dd63cee7161717a6a8414ba9c6435af764 · Patch
• https://linux.oracle.com/errata/ELSA-2025-20480.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-21657 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-21657 · Vendor Advisory
• https://git.kernel.org/stable/c/6268d5bc10354fc2ab8d44a0cd3b042d49a0417e · Patch
• https://ubuntu.com/security/CVE-2025-21657 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-21657 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-21657 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-20530.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04065 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-21657 · Security Note
• https://twitter.com/CVEnew/status/1881687721191641155 · Twitter Post