CVE-2025-21802

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21802
In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix oops when unload drivers paralleling When unload hclge driver, it tries to disable sriov first for each ae_dev node from hnae3_ae_dev_list. If user unloads hns3 driver at the time, because it removes all the ae_dev nodes, and it may cause oops. But we can't simply use hnae3_common_lock for this. Because in the process flow of pci_disable_sriov(), it will trigger the remove flow of VF, which will also take hnae3_common_lock. To fixes it, introduce a new mutex to protect the unload process.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/622d92a67656e5c4d2d6ccac02d688ed995418c6 Patch
https://git.kernel.org/stable/c/82736bb83fb0221319c85c2e9917d0189cd84e1e Patch
https://git.kernel.org/stable/c/8c640dd3d900cc8988a39c007591f1deee776df4 Patch
https://git.kernel.org/stable/c/92e5995773774a3e70257e9c95ea03518268bea5 Patch
https://git.kernel.org/stable/c/b5a8bc47aa0a4aa8bca5466dfa2d12dbb5b3cd0c Patch
https://git.kernel.org/stable/c/cafe9a27e22736d4a01b3933e36225f9857c7988 Patch
https://git.kernel.org/stable/c/e876522659012ef2e73834a0b9f1cbe3f74d5fad Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:rc7:*:*:*:*:*:*
History

30 Oct 2025, 21:35

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/622d92a67656e5c4d2d6ccac02d688ed995418c6 - () https://git.kernel.org/stable/c/622d92a67656e5c4d2d6ccac02d688ed995418c6 - Patch
References () https://git.kernel.org/stable/c/82736bb83fb0221319c85c2e9917d0189cd84e1e - () https://git.kernel.org/stable/c/82736bb83fb0221319c85c2e9917d0189cd84e1e - Patch
References () https://git.kernel.org/stable/c/8c640dd3d900cc8988a39c007591f1deee776df4 - () https://git.kernel.org/stable/c/8c640dd3d900cc8988a39c007591f1deee776df4 - Patch
References () https://git.kernel.org/stable/c/92e5995773774a3e70257e9c95ea03518268bea5 - () https://git.kernel.org/stable/c/92e5995773774a3e70257e9c95ea03518268bea5 - Patch
References () https://git.kernel.org/stable/c/b5a8bc47aa0a4aa8bca5466dfa2d12dbb5b3cd0c - () https://git.kernel.org/stable/c/b5a8bc47aa0a4aa8bca5466dfa2d12dbb5b3cd0c - Patch
References () https://git.kernel.org/stable/c/cafe9a27e22736d4a01b3933e36225f9857c7988 - () https://git.kernel.org/stable/c/cafe9a27e22736d4a01b3933e36225f9857c7988 - Patch
References () https://git.kernel.org/stable/c/e876522659012ef2e73834a0b9f1cbe3f74d5fad - () https://git.kernel.org/stable/c/e876522659012ef2e73834a0b9f1cbe3f74d5fad - Patch
CPE cpe:2.3:o:linux:linux_kernel:5.15:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CWE NVD-CWE-noinfo
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

13 Mar 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/622d92a67656e5c4d2d6ccac02d688ed995418c6 -
  • () https://git.kernel.org/stable/c/8c640dd3d900cc8988a39c007591f1deee776df4 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: hns3: se corrige el error al descargar controladores en paralelo. Al descargar el controlador hclge, primero intenta deshabilitar sriov para cada nodo ae_dev de hnae3_ae_dev_list. Si el usuario descarga el controlador hns3 en ese momento, debido a que elimina todos los nodos ae_dev, y puede causar errores. Pero no podemos simplemente usar hnae3_common_lock para esto. Porque en el flujo de proceso de pci_disable_sriov(), activará el flujo de eliminación de VF, que también tomará hnae3_common_lock. Para solucionarlo, introduzca un nuevo mutex para proteger el proceso de descarga.

27 Feb 2025, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-27 20:16

Updated : 2025-10-30 21:35

NVD link : CVE-2025-21802

Mitre link : CVE-2025-21802

CVE.ORG link : CVE-2025-21802

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo