PT-2025-8998 · Linux+2 · Linux Kernel+2

Published 2025-01-10 · Updated 2026-03-13 · CVE-2025-21807

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A potential deadlock situation exists in the Linux kernel due to the queue freeze vs limits lock order in sysfs store methods. This issue arises when a user attempts to modify a limit, thus freezing the device queue, while the device driver starts a revalidation of the device queue limits. The problem occurs because some drivers, such as SCSI sd, may need to issue commands to a device to obtain limit values from the hardware with the queue limits locked. This creates an ABBA deadlock situation.

Recommendations To resolve this issue, the queue freeze should not be performed before calling the ->store limit() method in struct queue sysfs entry. Instead, use the queue limits commit update frozen helper to freeze the queue after taking the limits lock. Additionally, avoid taking the sysfs lock for the store limit method as it does not provide any protection and creates more nesting.

Exploit

Fix

Improper Locking

Weakness Enumeration

CWE-833

CWE-667

Related Identifiers

BDU:2026-03992

CVE-2025-21807

Affected Products

Astra Linux

Debian

Linux Kernel

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21807.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-21807 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2025-21807 · Vendor Advisory
• https://git.kernel.org/stable/c/8985da5481562e96b95e94ed8e5cc9b6565eb82b · Patch
• https://git.kernel.org/stable/c/c99f66e4084a62a2cc401c4704a84328aeddc9ec · Patch
• https://bdu.fstec.ru/vul/2026-03992 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2025-21807 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-21807 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-21807 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-21807 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21807 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-21807 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-21807 · Vendor Advisory
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.13.2 · Note
• https://access.redhat.com/security/cve/cve-2025-21807 · Note