CVE-2025-21694 fs/proc: fix softlockup in __read_vmcore (part 2)
A softlockup in the Linux kernel's vmcore reading function can cause crash dumps to hang, leading to a denial of service during system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21694?
CVE-2025-21694 is a medium-severity denial of service vulnerability in Linux kernel, published on 12 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fs/proc: fix softlockup in __read_vmcore (part 2)
Since commit 5cbcb62dddf5 ("fs/proc: fix softlockup in __read_vmcore") the number of softlockups in __read_vmcore at kdump time have gone down, but they still happen sometimes.
In a memory constrained environment like the kdump image, a softlockup is not just a harmless message, but it can interfere with things like RCU freeing memory, causing the crashdump to get stuck.
The second loop in __read_vmcore has a lot more opportunities for natural sleep points, like scheduling out while waiting for a data write to happen, but apparently that is not always enough.
Add a cond_resched() to the second loop in __read_vmcore to (hopefully) get rid of the softlockups.
Which versions are affected by CVE-2025-21694?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21694?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-21694 being exploited?
There is no known exploitation of CVE-2025-21694 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-56800, AZL-56831, BELL-CVE-2025-21694, DEBIAN-CVE-2025-21694, GHSA-8mjp-767h-9569, UBUNTU-CVE-2025-21694.