CVE-2025-21634: cgroup/cpuset: remove kernfs active break
In the Linux kernel, the following vulnerability has been resolved:
cgroup/cpuset: remove kernfs active break
A warning was found:
WARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828 CPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G RIP: 0010:kernfsshoulddrainopenfiles+0x1a1/0x1b0 RSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202 RAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000 RDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04 RBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180 R10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08 R13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0 FS: 00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kernfsdrain+0x15e/0x2f0 kernfsremove+0x165/0x300 kernfsremovebynamens+0x7b/0xc0 cgrouprmfile+0x154/0x1c0 cgroupaddrmfiles+0x1c2/0x1f0 csscleardir+0x77/0x110 killcss+0x4c/0x1b0 cgroupdestroylocked+0x194/0x380 cgrouprmdir+0x2a/0x140
It can be explained by: rmdir echo 1 > cpuset.cpus kernfsfopwriteiter // active=0 cgrouprmfile kernfsremovebynamens kernfsgetactive // active=1 kernfsremove // active=0x80000002 kernfsdrain cpusetwriteresmask waitevent //waiting (active == 0x80000001) kernfsbreakactiveprotection // active = 0x80000001 // continue kernfsunbreakactiveprotection // active = 0x80000002 ... kernfsshoulddrainopenfiles // warning occurs kernfsputactive
This warning is caused by 'kernfsbreakactiveprotection' when it is writing to cpuset.cpus, and the cgroup is removed concurrently.
The commit 3a5a6d0c2b03 ("cpuset: don't nest cgroupmutex inside getonlinecpus()") made cpusethotplugworkfn asynchronous, This change involves calling flushwork(), which can create a multiple processes circular locking dependency that involve cgroupmutex, potentially leading to a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 ("cpuset: break kernfs active protection in cpusetwriteresmask()") added 'kernfsbreakactiveprotection' in the cpusetwriteresmask. This could lead to this warning.
After the commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing synchronous"), the cpusetwriteresmask no longer needs to wait the hotplug to finish, which means that concurrent hotplug and cpuset operations are no longer possible. Therefore, the deadlock doesn't exist anymore and it does not have to 'break active protection' now. To fix this warning, just remove kernfsbreakactiveprotection operation in the 'cpusetwriteresmask'.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21634?
CVE-2025-21634 presents a medium severity vulnerability associated with the Linux kernel's cgroup and cpuset functionality.
How do I fix CVE-2025-21634?
To fix CVE-2025-21634, you should update your Linux kernel to a version that contains the resolved vulnerability, preferably beyond 6.12.10.
Which Linux kernel versions are affected by CVE-2025-21634?
CVE-2025-21634 affects Linux kernel versions from 3.16 up to 6.12.10 and specific release candidates of 6.13.
What specific issue does CVE-2025-21634 address?
CVE-2025-21634 addresses the removal of the active break in the kernfs implementation in Linux kernel cgroups.
How can I determine if my system is vulnerable to CVE-2025-21634?
You can determine if your system is vulnerable to CVE-2025-21634 by checking the current Linux kernel version against the affected version ranges.