CVE-2025-21951

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock

There are multiple places from where the recovery work gets scheduled

asynchronously. Also, there are multiple places where the caller waits

synchronously for the recovery to be completed. One such place is during

the PM shutdown() callback.

If the device is not alive during recovery_work, it will try to reset the

device using pci_reset_function(). This function internally will take the

device_lock() first before resetting the device. By this time, if the lock

has already been acquired, then recovery_work will get stalled while

waiting for the lock. And if the lock was already acquired by the caller

which waits for the recovery_work to be completed, it will lead to

deadlock.

This is what happened on the X1E80100 CRD device when the device died

before shutdown() callback. Driver core calls the driver's shutdown()

callback while holding the d

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References