CVE-2025-21651 net: hns3: don't auto enable misc vector
A race condition in the HNS3 network driver can cause a kernel warning and potential instability if an interrupt occurs before service initialization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21651?
CVE-2025-21651 is a medium-severity vulnerability in Linux kernel, published on 19 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: hns3: don't auto enable misc vector
Currently, there is a time window between misc irq enabled and service task inited. If an interrupte is reported at this time, it will cause warning like below:
[ 16.324639] Call trace: [ 16.324641] __queue_delayed_work+0xb8/0xe0 [ 16.324643] mod_delayed_work_on+0x78/0xd0 [ 16.324655] hclge_errhand_task_schedule+0x58/0x90 [hclge] [ 16.324662] hclge_misc_irq_handle+0x168/0x240 [hclge] [ 16.324666] __handle_irq_event_percpu+0x64/0x1e0 [ 16.324667] handle_irq_event+0x80/0x170 [ 16.324670] handle_fasteoi_edge_irq+0x110/0x2bc [ 16.324671] __handle_domain_irq+0x84/0xfc [ 16.324673] gic_handle_irq+0x88/0x2c0 [ 16.324674] el1_irq+0xb8/0x140 [ 16.324677] arch_cpu_idle+0x18/0x40 [ 16.324679] default_idle_call+0x5c/0x1bc [ 16.324682] cpuidle_idle_call+0x18c/0x1c4 [ 16.324684] do_idle+0x174/0x17c [ 16.324685] cpu_startup_entry+0x30/0x6c [ 16.324687] secondary_start_kernel+0x1a4/0x280 [ 16.324688] ---[ end trace 6aa0bff672a964aa ]---
So don't auto enable misc vector when request irq..
Weakness: CWE-362
Which versions are affected by CVE-2025-21651?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21651?
Apply the vendor's patch.
Is CVE-2025-21651 being exploited?
There is no known exploitation of CVE-2025-21651 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-21651, DEBIAN-CVE-2025-21651, GHSA-27hv-jcq3-jj36, ROOT-OS-DEBIAN-11-CVE-2025-21651, ROOT-OS-DEBIAN-12-CVE-2025-21651, ROOT-OS-UBUNTU-2204-CVE-2025-21651 and 1 more.