Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-21634— cgroup/cpuset: remove kernfs active break

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在cpuset_write_resmask函数中，kernfs_break_active_protection可能会在并发操作时导致警告。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.14% · P4

Possible ATT&CK Techniques 1 AI

T1562

Affected Version Matrix 6

VendorProduct Version RangeStatus
Linux Linux 76bb5ab8f6e3e7bebdcefec4146ff305e7d0b465< 11cb1d643a74665a4e14749414f48f82cbc15c64 affected
76bb5ab8f6e3e7bebdcefec4146ff305e7d0b465< 3cb97a927fffe443e1e7e8eddbfebfdb062e86ed affected
3.16 affected
< 3.16 unaffected
6.12.10≤ 6.12.* unaffected
6.13≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-21634

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
cgroup/cpuset: remove kernfs active break
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: remove kernfs active break A warning was found: WARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828 CPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G RIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0 RSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202 RAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000 RDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04 RBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180 R10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08 R13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0 FS: 00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kernfs_drain+0x15e/0x2f0 __kernfs_remove+0x165/0x300 kernfs_remove_by_name_ns+0x7b/0xc0 cgroup_rm_file+0x154/0x1c0 cgroup_addrm_files+0x1c2/0x1f0 css_clear_dir+0x77/0x110 kill_css+0x4c/0x1b0 cgroup_destroy_locked+0x194/0x380 cgroup_rmdir+0x2a/0x140 It can be explained by: rmdir echo 1 > cpuset.cpus kernfs_fop_write_iter // active=0 cgroup_rm_file kernfs_remove_by_name_ns kernfs_get_active // active=1 __kernfs_remove // active=0x80000002 kernfs_drain cpuset_write_resmask wait_event //waiting (active == 0x80000001) kernfs_break_active_protection // active = 0x80000001 // continue kernfs_unbreak_active_protection // active = 0x80000002 ... kernfs_should_drain_open_files // warning occurs kernfs_put_active This warning is caused by 'kernfs_break_active_protection' when it is writing to cpuset.cpus, and the cgroup is removed concurrently. The commit 3a5a6d0c2b03 ("cpuset: don't nest cgroup_mutex inside get_online_cpus()") made cpuset_hotplug_workfn asynchronous, This change involves calling flush_work(), which can create a multiple processes circular locking dependency that involve cgroup_mutex, potentially leading to a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 ("cpuset: break kernfs active protection in cpuset_write_resmask()") added 'kernfs_break_active_protection' in the cpuset_write_resmask. This could lead to this warning. After the commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing synchronous"), the cpuset_write_resmask no longer needs to wait the hotplug to finish, which means that concurrent hotplug and cpuset operations are no longer possible. Therefore, the deadlock doesn't exist anymore and it does not have to 'break active protection' now. To fix this warning, just remove kernfs_break_active_protection operation in the 'cpuset_write_resmask'.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在cpuset_write_resmask函数中，kernfs_break_active_protection可能会在并发操作时导致警告。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 76bb5ab8f6e3e7bebdcefec4146ff305e7d0b465 ~ 11cb1d643a74665a4e14749414f48f82cbc15c64 -
Linux Linux 3.16 -

II. Public POCs for CVE-2025-21634

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-21634

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-21634 (2)

Same Patch Batch · Linux · 2025-01-19 · 47 CVEs total

CVE-2024-57929 7.8 HIGH dm array: fix releasing a faulty array block twice in dm_array_cursor_end
CVE-2025-21631 7.8 HIGH block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
CVE-2025-21652 7.8 HIGH ipvlan: Fix use-after-free in ipvlan_get_iflink().
CVE-2024-57918 7.8 HIGH drm/amd/display: fix page fault due to max surface definition mismatch
CVE-2024-57921 7.8 HIGH drm/amdgpu: Add a lock when accessing the buddy trim function
CVE-2024-57926 7.8 HIGH drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err
CVE-2025-21646 7.5 HIGH afs: Fix the maximum cell name length
CVE-2025-21647 7.3 HIGH sched: sch_cake: add bounds checks to host bulk flow fairness counts
CVE-2025-21637 7.1 HIGH sctp: sysctl: udp_port: avoid using current->nsproxy
CVE-2025-21650 7.1 HIGH net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue
CVE-2025-21640 7.1 HIGH sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
CVE-2025-21638 7.1 HIGH sctp: sysctl: auth_enable: avoid using current->nsproxy
CVE-2024-57927 nfs: Fix oops in nfs_netfs_init_request() when copying to cache
CVE-2024-57925 ksmbd: fix a missing return value check bug
CVE-2024-57914 usb: typec: tcpci: fix NULL pointer issue on shared irq case
CVE-2024-57913 usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
CVE-2024-57911 iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
CVE-2024-57910 iio: light: vcnl4035: fix information leak in triggered buffer
CVE-2024-57916 misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
CVE-2024-57912 iio: pressure: zpa2326: fix information leak in triggered buffer

Showing top 20 of 47 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-21634

No comments yet

Leave a comment