Executive brief
A race condition vulnerability was identified in the Linux kernel's networking subsystem. It occurs when a network device is being removed from the system at the same time its configuration is being modified via the ethtool utility. An exploit could lead to a system crash or instability, potentially causing a denial of service for the affected machine.
Technical details
A race condition exists between network device unregistration and ethtool Netlink (ethnl) operations. The vulnerability is rooted in the fact that 'unregister_netdevice_many_notify' can execute before the 'rtnl' lock section of certain ethnl operations (such as 'set_channels'). This can result in resources, like the RSS lock, being destroyed while still in use by the configuration path. The fix expands the check in 'ethnl_ops_begin' to deny operations on any device that has entered the 'NETREG_UNREGISTERING' state or further. This issue specifically affects the Netlink interface and not the older ioctl-based ethtool interface.
Affected products
- Linux Linux Kernel 5.10.87 to 5.11, 5.15.8 to 5.15.179, 5.16.1 to 6.1.129, 6.2 to 6.6.76, 6.7 to 6.12.13, 6.13 to 6.13.2
Timeline
- 2025-01-16: patched: Initial patch submitted by Antoine Tenart
- 2025-02-13: disclosed: CVE-2025-21701 published
References
- https://git.kernel.org/stable/c/12e070eb6964b341b41677fd260af5a305316a1f
- https://git.kernel.org/stable/c/26bc6076798aa4dc83a07d0a386f9e57c94e8517
- https://git.kernel.org/stable/c/2f29127e94ae9fdc7497331003d6860e9551cdf3
- https://git.kernel.org/stable/c/4dc880245f9b529fa8f476b5553c799d2848b47b
- https://git.kernel.org/stable/c/b1cb37a31a482df3dd35a6ac166282dac47664f4
- https://git.kernel.org/stable/c/b382ab9b885cbb665e0e70a727f101c981b4edf3
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html