Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-21701 is a high-severity Race Condition (CWE-362) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-39 (Process Isolation) and SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-21701 is a race condition vulnerability in the Linux kernel's networking subsystem, specifically involving a timing issue between network device unregistration and ethtool netlink (ethnl) operations such as modifying the number of channels. The flaw manifests when unregister_netdevice_many_notify executes before the rtnl lock section in ethnl operations, potentially leading to misuse of locks like the RSS lock after it has been destroyed during device teardown. This affects Linux kernel versions vulnerable to the issue, as demonstrated in a kernel warning trace from version 6.13.0-rc6 during ethtool execution.
A local attacker with low privileges can exploit this vulnerability by running ethnl operations, such as ethnl_set_channels via ethtool, concurrently with network device unregistration. The attack requires high complexity due to the precise timing needed for the race. Successful exploitation results in a denial of service, such as kernel warnings (e.g., DEBUG_LOCKS_WARN_ON in __mutex_lock), potential crashes, or system instability from improper lock handling, with no impact on confidentiality or integrity. The ioctl version of ethtool (__dev_ethtool) is unaffected because it retrieves the device reference within the rtnl lock section.
Mitigation is provided through kernel patches available in stable repositories, including commits such as 12e070eb6964b341b41677fd260af5a305316a1f, 26bc6076798aa4dc83a07d0a386f9e57c94e8517, 2f29127e94ae9fdc7497331003d6860e9551cdf3, 4dc880245f9b529fa8f476b5553c799d2848b47b, and b1cb37a31a482df3dd35a6ac166282dac47664f4. These patches address the issue by denying ethnl operations on devices undergoing unregistration, expanding an existing check in ethnl_ops_begin to prevent such races.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2650
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: net: avoid race between device unregistration and ethnl ops The following trace can be seen if a device is being unregistered while its number of channels are being modified. DEBUG_LOCKS_WARN_ON(lock->magic…
more
!= lock) WARNING: CPU: 3 PID: 3754 at kernel/locking/mutex.c:564 __mutex_lock+0xc8a/0x1120 CPU: 3 UID: 0 PID: 3754 Comm: ethtool Not tainted 6.13.0-rc6+ #771 RIP: 0010:__mutex_lock+0xc8a/0x1120 Call Trace: <TASK> ethtool_check_max_channel+0x1ea/0x880 ethnl_set_channels+0x3c3/0xb10 ethnl_default_set_doit+0x306/0x650 genl_family_rcv_msg_doit+0x1e3/0x2c0 genl_rcv_msg+0x432/0x6f0 netlink_rcv_skb+0x13d/0x3b0 genl_rcv+0x28/0x40 netlink_unicast+0x42e/0x720 netlink_sendmsg+0x765/0xc20 __sys_sendto+0x3ac/0x420 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e This is because unregister_netdevice_many_notify might run before the rtnl lock section of ethnl operations, eg. set_channels in the above example. In this example the rss lock would be destroyed by the device unregistration path before being used again, but in general running ethnl operations while dismantle has started is not a good idea. Fix this by denying any operation on devices being unregistered. A check was already there in ethnl_ops_begin, but not wide enough. Note that the same issue cannot be seen on the ioctl version (__dev_ethtool) because the device reference is retrieved from within the rtnl lock section there. Once dismantle started, the net device is unlisted and no reference will be found.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Maintaining separate execution domains for each process structurally eliminates unintended concurrent access to the same shared resources.
Preventing unintended information transfer through shared system resources directly addresses the improper concurrent modification that defines a race condition.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect race conditions, but does not prevent them at design or coding time.
Secure coding standards explicitly forbid unsafe concurrent access patterns and mandate atomic operations or locks.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-362, a class-level weakness, and none of its children carries one either.