CVE-2025-21701
Published: 13 February 2025
Summary
CVE-2025-21701 is a medium-severity Race Condition (CWE-362) vulnerability in Linux Linux Kernel. Its CVSS base score is 4.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 2.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely application of kernel patches denying ethnl operations on unregistering devices directly eliminates the race condition in CVE-2025-21701.
Vulnerability scanning identifies Linux kernel versions vulnerable to CVE-2025-21701, enabling targeted remediation.
System monitoring of kernel logs detects exploitation indicators like DEBUG_LOCKS_WARN_ON during ethtool netlink operations concurrent with device unregistration.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Race condition in Linux kernel networking/ethtool allows local low-priv user to trigger DoS via system exploitation (crashes/instability).
NVD Description
In the Linux kernel, the following vulnerability has been resolved: net: avoid race between device unregistration and ethnl ops The following trace can be seen if a device is being unregistered while its number of channels are being modified. DEBUG_LOCKS_WARN_ON(lock->magic…
more
!= lock) WARNING: CPU: 3 PID: 3754 at kernel/locking/mutex.c:564 __mutex_lock+0xc8a/0x1120 CPU: 3 UID: 0 PID: 3754 Comm: ethtool Not tainted 6.13.0-rc6+ #771 RIP: 0010:__mutex_lock+0xc8a/0x1120 Call Trace: <TASK> ethtool_check_max_channel+0x1ea/0x880 ethnl_set_channels+0x3c3/0xb10 ethnl_default_set_doit+0x306/0x650 genl_family_rcv_msg_doit+0x1e3/0x2c0 genl_rcv_msg+0x432/0x6f0 netlink_rcv_skb+0x13d/0x3b0 genl_rcv+0x28/0x40 netlink_unicast+0x42e/0x720 netlink_sendmsg+0x765/0xc20 __sys_sendto+0x3ac/0x420 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e This is because unregister_netdevice_many_notify might run before the rtnl lock section of ethnl operations, eg. set_channels in the above example. In this example the rss lock would be destroyed by the device unregistration path before being used again, but in general running ethnl operations while dismantle has started is not a good idea. Fix this by denying any operation on devices being unregistered. A check was already there in ethnl_ops_begin, but not wide enough. Note that the same issue cannot be seen on the ioctl version (__dev_ethtool) because the device reference is retrieved from within the rtnl lock section there. Once dismantle started, the net device is unlisted and no reference will be found.
Deeper analysisAI
CVE-2025-21701 is a race condition vulnerability in the Linux kernel's networking subsystem, specifically involving a timing issue between network device unregistration and ethtool netlink (ethnl) operations such as modifying the number of channels. The flaw manifests when unregister_netdevice_many_notify executes before the rtnl lock section in ethnl operations, potentially leading to misuse of locks like the RSS lock after it has been destroyed during device teardown. This affects Linux kernel versions vulnerable to the issue, as demonstrated in a kernel warning trace from version 6.13.0-rc6 during ethtool execution.
A local attacker with low privileges can exploit this vulnerability by running ethnl operations, such as ethnl_set_channels via ethtool, concurrently with network device unregistration. The attack requires high complexity due to the precise timing needed for the race. Successful exploitation results in a denial of service, such as kernel warnings (e.g., DEBUG_LOCKS_WARN_ON in __mutex_lock), potential crashes, or system instability from improper lock handling, with no impact on confidentiality or integrity. The ioctl version of ethtool (__dev_ethtool) is unaffected because it retrieves the device reference within the rtnl lock section.
Mitigation is provided through kernel patches available in stable repositories, including commits such as 12e070eb6964b341b41677fd260af5a305316a1f, 26bc6076798aa4dc83a07d0a386f9e57c94e8517, 2f29127e94ae9fdc7497331003d6860e9551cdf3, 4dc880245f9b529fa8f476b5553c799d2848b47b, and b1cb37a31a482df3dd35a6ac166282dac47664f4. These patches address the issue by denying ethnl operations on devices undergoing unregistration, expanding an existing check in ethnl_ops_begin to prevent such races.
Details
- CWE(s)