{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2025-21983 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-21983 is a high-severity denial of service vulnerability in Linux kernel, published on 1 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-21983 and fix it if it is affected.\n\nWhat it is: CVE-2025-21983 is a high-severity denial of service vulnerability in Linux kernel, published on 1 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-21983 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-21983/ (Markdown: https://insights.sbomify.com/CVE-2025-21983/index.md)","id":"CVE-2025-21983","markdown":"https://insights.sbomify.com/CVE-2025-21983/index.md","name":"CVE-2025-21983","record":{"aliases":["BELL-CVE-2025-21983","DEBIAN-CVE-2025-21983","GHSA-jxrr-3gxj-w229","UBUNTU-CVE-2025-21983"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A kernel warning in kvfree_rcu can lead to system instability or crashes, requiring a patch to switch workqueue flags.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":7.8,"severity":"high","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab/kvfree_rcu: Switch to WQ_MEM_RECLAIM wq\n\nCurrently kvfree_rcu() APIs use a system workqueue which is\n\"system_unbound_wq\" to driver RCU machinery to reclaim a memory.\n\nRecently, it has been noted that the following kernel warning can\nbe observed:\n\n\u003csnip\u003e\nworkqueue: WQ_MEM_RECLAIM nvme-wq:nvme_scan_work is flushing !WQ_MEM_RECLAIM events_unbound:kfree_rcu_work\n  WARNING: CPU: 21 PID: 330 at kernel/workqueue.c:3719 check_flush_dependency+0x112/0x120\n  Modules linked in: intel_uncore_frequency(E) intel_uncore_frequency_common(E) skx_edac(E) ...\n  CPU: 21 UID: 0 PID: 330 Comm: kworker/u144:6 Tainted: G            E      6.13.2-0_g925d379822da #1\n  Hardware name: Wiwynn Twin Lakes MP/Twin Lakes Passive MP, BIOS YMM20 02/01/2023\n  Workqueue: nvme-wq nvme_scan_work\n  RIP: 0010:check_flush_dependency+0x112/0x120\n  Code: 05 9a 40 14 02 01 48 81 c6 c0 00 00 00 48 8b 50 18 48 81 c7 c0 00 00 00 48 89 f9 48 ...\n  RSP: 0018:ffffc90000df7bd8 EFLAGS: 00010082\n  RAX: 000000000000006a RBX: ffffffff81622390 RCX: 0000000000000027\n  RDX: 00000000fffeffff RSI: 000000000057ffa8 RDI: ffff88907f960c88\n  RBP: 0000000000000000 R08: ffffffff83068e50 R09: 000000000002fffd\n  R10: 0000000000000004 R11: 0000000000000000 R12: ffff8881001a4400\n  R13: 0000000000000000 R14: ffff88907f420fb8 R15: 0000000000000000\n  FS:  0000000000000000(0000) GS:ffff88907f940000(0000) knlGS:0000000000000000\n  CR2: 00007f60c3001000 CR3: 000000107d010005 CR4: 00000000007726f0\n  PKRU: 55555554\n  Call Trace:\n   \u003cTASK\u003e\n   ? __warn+0xa4/0x140\n   ? check_flush_dependency+0x112/0x120\n   ? report_bug+0xe1/0x140\n   ? check_flush_dependency+0x112/0x120\n   ? handle_bug+0x5e/0x90\n   ? exc_invalid_op+0x16/0x40\n   ? asm_exc_invalid_op+0x16/0x20\n   ? timer_recalc_next_expiry+0x190/0x190\n   ? check_flush_dependency+0x112/0x120\n   ? check_flush_dependency+0x112/0x120\n   __flush_work.llvm.1643880146586177030+0x174/0x2c0\n   flush_rcu_work+0x28/0x30\n   kvfree_rcu_barrier+0x12f/0x160\n   kmem_cache_destroy+0x18/0x120\n   bioset_exit+0x10c/0x150\n   disk_release.llvm.6740012984264378178+0x61/0xd0\n   device_release+0x4f/0x90\n   kobject_put+0x95/0x180\n   nvme_put_ns+0x23/0xc0\n   nvme_remove_invalid_namespaces+0xb3/0xd0\n   nvme_scan_work+0x342/0x490\n   process_scheduled_works+0x1a2/0x370\n   worker_thread+0x2ff/0x390\n   ? pwq_release_workfn+0x1e0/0x1e0\n   kthread+0xb1/0xe0\n   ? __kthread_parkme+0x70/0x70\n   ret_from_fork+0x30/0x40\n   ? __kthread_parkme+0x70/0x70\n   ret_from_fork_asm+0x11/0x20\n   \u003c/TASK\u003e\n  ---[ end trace 0000000000000000 ]---\n\u003csnip\u003e\n\nTo address this switch to use of independent WQ_MEM_RECLAIM\nworkqueue, so the rules are not violated from workqueue framework\npoint of view.\n\nApart of that, since kvfree_rcu() does reclaim memory it is worth\nto go with WQ_MEM_RECLAIM type of wq because it is designed for\nthis purpose.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"mm/slab/kvfree_rcu: Switch to WQ_MEM_RECLAIM wq","id":"CVE-2025-21983","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"denial_of_service","year":"2025"},"n_packages":0,"n_references":3,"next":{"headline":"mm: fix kernel BUG when userfaultfd_move encounters swapcache","id":"CVE-2025-21984"},"packages":[],"prev":{"headline":"pinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xx_gpio_fw","id":"CVE-2025-21982"},"products":["Linux"],"published":"2025-04-01","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A kernel warning in kvfree_rcu can lead to system instability or crashes, requiring a patch to switch workqueue flags.","url":"https://insights.sbomify.com/CVE-2025-21983/"}