CVE-2025-21825

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT

During the update procedure, when overwrite element in a pre-allocated

htab, the freeing of old_element is protected by the bucket lock. The

reason why the bucket lock is necessary is that the old_element has

already been stashed in htab->extra_elems after alloc_htab_elem()

returns. If freeing the old_element after the bucket lock is unlocked,

the stashed element may be reused by concurrent update procedure and the

freeing of old_element will run concurrently with the reuse of the

old_element. However, the invocation of check_and_free_fields() may

acquire a spin-lock which violates the lockdep rule because its caller

has already held a raw-spin-lock (bucket lock). The following warning

will be reported when such race happens:

BUG: scheduling while atomic: test_progs/676/0x00000003

3 locks held by test_progs/676:

#0: ffffffff864b0240 (rcu_read_loc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References