CVE-2025-21986

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: switchdev: Convert blocking notification chain to a raw one

A blocking notification chain uses a read-write semaphore to protect the

integrity of the chain. The semaphore is acquired for writing when

adding / removing notifiers to / from the chain and acquired for reading

when traversing the chain and informing notifiers about an event.

In case of the blocking switchdev notification chain, recursive

notifications are possible which leads to the semaphore being acquired

twice for reading and to lockdep warnings being generated [1].

Specifically, this can happen when the bridge driver processes a

SWITCHDEV_BRPORT_UNOFFLOADED event which causes it to emit notifications

about deferred events when calling switchdev_deferred_process().

Fix this by converting the notification chain to a raw notification

chain in a similar fashion to the netdev notification chain. Protect

the chain using the RTNL mutex by acquiring i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References