CVE-2025-21820 tty: xilinx_uartps: split sysrq handling
A race condition in the Xilinx UART driver can cause a deadlock, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21820?
CVE-2025-21820 is a medium-severity vulnerability in Linux kernel, published on 27 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tty: xilinx_uartps: split sysrq handling
lockdep detects the following circular locking dependency:
CPU 0 CPU 1 ========================== ============================ cdns_uart_isr() printk() uart_port_lock(port) console_lock() cdns_uart_console_write() if (!port->sysrq) uart_port_lock(port) uart_handle_break() port->sysrq = ... uart_handle_sysrq_char() printk() console_lock()
The fixed commit attempts to avoid this situation by only taking the port lock in cdns_uart_console_write if port->sysrq unset. However, if (as shown above) cdns_uart_console_write runs before port->sysrq is set, then it will try to take the port lock anyway. This may result in a deadlock.
Fix this by splitting sysrq handling into two parts. We use the prepare helper under the port lock and defer handling until we release the lock.
Weakness: CWE-667
Which versions are affected by CVE-2025-21820?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21820?
Apply the vendor's patch.
Is CVE-2025-21820 being exploited?
There is no known exploitation of CVE-2025-21820 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-57749, BELL-CVE-2025-21820, DEBIAN-CVE-2025-21820, GHSA-pgjm-rqqp-m93m, ROOT-OS-DEBIAN-11-CVE-2025-21820, ROOT-OS-UBUNTU-2404-CVE-2025-21820 and 1 more.