Skip to content
OpenAdvisories
High · 7.5 CVE-2025-21809 EUVD-2025-5999GHSA-4fj4-ghwr-gjf7

rxrpc, afs: Fix peer hash locking vs RCU callback

Published Feb 27, 2025 · Updated Aug 5, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-azure-nvidia Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-6.8 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-lowlatency Package: linux-nvidia-tegra Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-xilinx Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc, afs: Fix peer hash locking vs RCU callback

In its address list, afs now retains pointers to and refs on one or more
rxrpc_peer objects. The address list is freed under RCU and at this time,
it puts the refs on those peers.

Now, when an rxrpc_peer object runs out of refs, it gets removed from the
peer hash table and, for that, rxrpc has to take a spinlock. However, it
is now being called from afs's RCU cleanup, which takes place in BH
context - but it is just taking an ordinary spinlock.

The put may also be called from non-BH context, and so there exists the
possibility of deadlock if the BH-based RCU cleanup happens whilst the hash
spinlock is held. This led to the attached lockdep complaint.

Fix this by changing spinlocks of rxnet->peer_hash_lock back to
BH-disabling locks.

================================
WARNING: inconsistent lock state
6.13.0-rc5-build2+ #1223 Tainted: G E
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
swapper/1/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff88810babe228 (&rxnet->peer_hash_lock){+.?.}-{3:3}, at: rxrpc_put_peer+0xcb/0x180
{SOFTIRQ-ON-W} state was registered at:
mark_usage+0x164/0x180
__lock_acquire+0x544/0x990
lock_acquire.part.0+0x103/0x280
_raw_spin_lock+0x2f/0x40
rxrpc_peer_keepalive_worker+0x144/0x440
process_one_work+0x486/0x7c0
process_scheduled_works+0x73/0x90
worker_thread+0x1c8/0x2a0
kthread+0x19b/0x1b0
ret_from_fork+0x24/0x40
ret_from_fork_asm+0x1a/0x30
irq event stamp: 972402
hardirqs last enabled at (972402): [<ffffffff8244360e>] _raw_spin_unlock_irqrestore+0x2e/0x50
hardirqs last disabled at (972401): [<ffffffff82443328>] _raw_spin_lock_irqsave+0x18/0x60
softirqs last enabled at (972300): [<ffffffff810ffbbe>] handle_softirqs+0x3ee/0x430
softirqs last disabled at (972313): [<ffffffff810ffc54>] __irq_exit_rcu+0x44/0x110

other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&rxnet->peer_hash_lock);
<Interrupt>
lock(&rxnet->peer_hash_lock);

*** DEADLOCK ***
1 lock held by swapper/1/0:
#0: ffffffff83576be0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire+0x7/0x30

stack backtrace:
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G E 6.13.0-rc5-build2+ #1223
Tainted: [E]=UNSIGNED_MODULE
Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
Call Trace:
<IRQ>
dump_stack_lvl+0x57/0x80
print_usage_bug.part.0+0x227/0x240
valid_state+0x53/0x70
mark_lock_irq+0xa5/0x2f0
mark_lock+0xf7/0x170
mark_usage+0xe1/0x180
__lock_acquire+0x544/0x990
lock_acquire.part.0+0x103/0x280
_raw_spin_lock+0x2f/0x40
rxrpc_put_peer+0xcb/0x180
afs_free_addrlist+0x46/0x90 [kafs]
rcu_do_batch+0x2d2/0x640
rcu_core+0x2f7/0x350
handle_softirqs+0x1ee/0x430
__irq_exit_rcu+0x44/0x110
irq_exit_rcu+0xa/0x30
sysvec_apic_timer_interrupt+0x7f/0xa0
</IRQ>

Affected products

VendorProductAffectedFixed
Linux Linux 6.7.3 – < 6.8, 6.8 6.8

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.12.13-1 —
Debian 13 linux 6.12.13-1 —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux 6.8.0-64.67 USN-7651-1
Ubuntu 24.04 LTS linux-aws 6.8.0-1032.34 USN-7651-1
Ubuntu 24.04 LTS linux-azure 6.8.0-1034.39 USN-7737-1
Ubuntu 24.04 LTS linux-azure-nvidia 6.8.0-1022.23 USN-7737-1
Ubuntu 24.04 LTS linux-gcp 6.8.0-1033.35 USN-7651-4
Ubuntu 24.04 LTS linux-gcp-6.11 +1 6.11.0-1015.15~24.04.1 USN-7521-1
Ubuntu 24.04 LTS linux-gke 6.8.0-1028.32 USN-7651-3
Ubuntu 24.04 LTS linux-gkeop 6.8.0-1015.17 USN-7651-3
Ubuntu 24.04 LTS linux-hwe-6.11 6.11.0-26.26~24.04.1 USN-7521-1
Ubuntu 24.04 LTS linux-ibm 6.8.0-1029.29 USN-7651-2
Ubuntu 24.04 LTS linux-lowlatency 6.8.0-64.67.1 USN-7651-2
Ubuntu 24.04 LTS linux-lowlatency-hwe-6.11 6.11.0-1014.15~24.04.1 USN-7521-3
Ubuntu 24.04 LTS linux-nvidia 6.8.0-1031.34 USN-7651-3
Ubuntu 24.04 LTS linux-nvidia-6.11 6.11.0-1010.10 —
Ubuntu 24.04 LTS linux-nvidia-lowlatency 6.8.0-1031.34.1 USN-7651-3
Ubuntu 24.04 LTS linux-nvidia-tegra 6.8.0-1008.8 —
Ubuntu 24.04 LTS linux-oem-6.11 6.11.0-1022.22 USN-7521-1
Ubuntu 24.04 LTS linux-oem-6.8 6.8.0-1031.31 USN-7651-1
Ubuntu 24.04 LTS linux-oracle 6.8.0-1029.30 USN-7651-3
Ubuntu 24.04 LTS linux-raspi 6.8.0-1031.35 USN-7651-6
Ubuntu 24.04 LTS linux-riscv +2 No fix yet —
Ubuntu 24.04 LTS linux-xilinx 6.8.0-1017.18 —
Ubuntu 22.04 LTS linux-aws-6.8 6.8.0-1032.34~22.04.1 USN-7651-3
Ubuntu 22.04 LTS linux-azure-6.8 6.8.0-1034.39~22.04.1 USN-7737-1
Ubuntu 22.04 LTS linux-gcp-6.8 6.8.0-1033.35~22.04.1 USN-7651-4
Ubuntu 22.04 LTS linux-hwe-6.8 +1 6.8.0-64.67~22.04.1 USN-7653-1
Ubuntu 22.04 LTS linux-ibm-6.8 6.8.0-1029.29~22.04.1 USN-7651-2
Ubuntu 22.04 LTS linux-lowlatency-hwe-6.8 6.8.0-64.67.1~22.04.1 USN-7651-2
Ubuntu 22.04 LTS linux-nvidia-6.8 6.8.0-1031.34~22.04.1 USN-7651-3
Ubuntu 22.04 LTS linux-oracle-6.8 6.8.0-1029.30~22.04.1 USN-7651-3
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro Realtime 24.04 LTS linux-raspi-realtime 6.8.0-2026.27 USN-7651-5
Ubuntu Pro Realtime 24.04 LTS linux-realtime 6.8.1-1025.26 USN-7652-1
Ubuntu Pro Realtime 22.04 LTS linux-realtime-6.8 6.8.1-1025.26~22.04.1 —
Ubuntu Pro FIPS-updates 24.04 LTS linux-fips 6.8.0-78.78+fips1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 kernel-uek +34 6.12.0-101.33.4.3.el10uek ELSA-2025-20530, ELSA-2025-20480

Advisories 14

References