CVE-2025-21694

Description

In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix softlockup in __read_vmcore (part 2) Since commit 5cbcb62dddf5 ("fs/proc: fix softlockup in __read_vmcore") the number of softlockups in __read_vmcore at kdump time have gone down, but they still happen sometimes. In a memory constrained environment like the kdump image, a softlockup is not just a harmless message, but it can interfere with things like RCU freeing memory, causing the crashdump to get stuck. The second loop in __read_vmcore has a lot more opportunities for natural sleep points, like scheduling out while waiting for a data write to happen, but apparently that is not always enough. Add a cond_resched() to the second loop in __read_vmcore to (hopefully) get rid of the softlockups.

Gravité et risque d'exploitation

CVE-2025-21694 obtient un score CVSS de 5.5/10, soit une gravité moyenne. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.24 %, ce qui la place devant 14.4 % des CVE référencées.

Que faire ?

• Vérifiez si Linux (versions 6.13, <=6.1.*, 5.4.279, <=6.12.*, 6.10, 6.1.95, 7bdf1d550ddfcd9ab797087421f77b7aceddc8a7, 0, 5.10.234, 6.9.6, <6.10, <84c4ed15626574c9ac6c1039ba9c137a77bcc7f2, <80828540dad0757b6337c6561d49c81038f38d87, 6.12.11, <a5a2ee8144c3897d37403a69118c3e3dc5713958, <6.6.74, a373ad833a6bfe4bc6cedcf7e56a99cc6fd9a193, <80da29deb88a3a907441fc35bb7bac309f31e713, <5.10.234, <65c367bd9d4f43513c7f837df5753bea9561b836, e8780e8a0e25dc4c3927f611ec8970d26c0c7369, 6.6.35, <4.20, <=5.10.*, <=6.6.*, 5.4.290, 6.1.127, e1b160a50c756e0efbea290b9bf5117cb80e8c4b, 5.15.162, 5.15.177, <=5.4.*, <649b266606bc413407ce315f710c8ce8a88ee30a, 5.10.221, <5.4.290, 518fbd644dabb6aedbdd4939c6c9cc1bf651459f, <6.1.127, <=*, 70c1835e776c8447c1aca87ddb38cfe764fe756a, <=5.15.*, 803d5a33d5ffdc2d86dcc0cfa01655a330612cdb, 4.19.317, 5cbcb62dddf5346077feb82b7b0c9254222d3445, <cbc5dde0a461240046e8a41c43d7c3b76d5db952, 6.6.74, <5.15.177) est présent sur votre parc.
• Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
• À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
• Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

• https://git.kernel.org/stable/c/84c4ed15626574c9ac6c1039ba9c137a77bcc7f2
• https://git.kernel.org/stable/c/80da29deb88a3a907441fc35bb7bac309f31e713
• https://git.kernel.org/stable/c/649b266606bc413407ce315f710c8ce8a88ee30a
• https://git.kernel.org/stable/c/65c367bd9d4f43513c7f837df5753bea9561b836
• https://git.kernel.org/stable/c/a5a2ee8144c3897d37403a69118c3e3dc5713958
• https://git.kernel.org/stable/c/80828540dad0757b6337c6561d49c81038f38d87
• https://git.kernel.org/stable/c/cbc5dde0a461240046e8a41c43d7c3b76d5db952