UBUNTU-CVE-2025-21701: High severity ubuntu/linux-hwe-edge vulnerability

Q: What conditions are required to trigger this issue?

A local attacker with low privileges must race network-device unregistration against an ethtool netlink operation that modifies channel counts, such as set_channels. No user interaction is required.

Q: Which systems are exposed?

The affected software list includes Ubuntu linux-realtime, linux-azure, linux-gcp, linux-gke, linux-gkeop, linux-riscv, linux-fips, and linux-hwe-edge packages. The provided data does not identify specific affected or fixed package versions.

Q: How can I recognize a possible occurrence?

A possible indicator is a kernel DEBUG_LOCKS warning from __mutex_lock during an ethtool operation, with stack frames including ethtool_check_max_channel and ethnl_set_channels. The described failure occurs when a device's lock is destroyed during unregistration and then used by the concurrent operation.

Published Feb 13, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: net: avoid race between device unregistration and ethnl ops The following trace can be seen if a device is being unregistered while its number of channels are being modified. DEBUGLOCKSWARNON(lock->magic != lock) WARNING: CPU: 3 PID: 3754 at kernel/locking/mutex.c:564 mutexlock+0xc8a/0x1120 CPU: 3 UID: 0 PID: 3754 Comm: ethtool Not tainted 6.13.0-rc6+ #771 RIP: 0010:mutexlock+0xc8a/0x1120 Call Trace: <TASK> ethtoolcheckmaxchannel+0x1ea/0x880 ethnlsetchannels+0x3c3/0xb10 ethnldefaultsetdoit+0x306/0x650 genlfamilyrcvmsgdoit+0x1e3/0x2c0 genlrcvmsg+0x432/0x6f0 netlinkrcvskb+0x13d/0x3b0 genlrcv+0x28/0x40 netlinkunicast+0x42e/0x720 netlinksendmsg+0x765/0xc20 syssendto+0x3ac/0x420 x64syssendto+0xe0/0x1c0 dosyscall64+0x95/0x180 entrySYSCALL64afterhwframe+0x76/0x7e This is because unregisternetdevicemanynotify might run before the rtnl lock section of ethnl operations, eg. setchannels in the above example. In this example the rss lock would be destroyed by the device unregistration path before being used again, but in general running ethnl operations while dismantle has started is not a good idea. Fix this by denying any operation on devices being unregistered. A check was already there in ethnlopsbegin, but not wide enough. Note that the same issue cannot be seen on the ioctl version (devethtool) because the device reference is retrieved from within the rtnl lock section there. Once dismantle started, the net device is unlisted and no reference will be found.

Affected Software

153 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.15<5.15.0-1082.89~20.04.1

5.15.0-1082.89~20.04.1

ubuntu/linux-azure-5.15<5.15.0-1087.96~20.04.1

5.15.0-1087.96~20.04.1

ubuntu/linux-gcp-5.15<5.15.0-1081.90~20.04.1

5.15.0-1081.90~20.04.1

ubuntu/linux-hwe-5.15<5.15.0-138.148~20.04.1

5.15.0-138.148~20.04.1

ubuntu/linux-ibm-5.15<5.15.0-1074.77~20.04.1

5.15.0-1074.77~20.04.1

ubuntu/linux-intel-iotg-5.15<5.15.0-1077.83~20.04.1

5.15.0-1077.83~20.04.1

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-138.148~20.04.1

5.15.0-138.148~20.04.1

ubuntu/linux-oracle-5.15<5.15.0-1079.85~20.04.1

5.15.0-1079.85~20.04.1

ubuntu/linux-riscv-5.15<5.15.0-1077.81~20.04.1

5.15.0-1077.81~20.04.1

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1039.39~20.04.1

5.15.0-1039.39~20.04.1

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux<5.15.0-138.148

5.15.0-138.148

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1082.89

5.15.0-1082.89

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1027.29~22.04.1

6.8.0-1027.29~22.04.1

ubuntu/linux-azure<5.15.0-1087.96

5.15.0-1087.96

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1027.32~22.04.1

6.8.0-1027.32~22.04.1

ubuntu/linux-azure-fde<5.15.0-1087.96.1

5.15.0-1087.96.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp<5.15.0-1081.90

5.15.0-1081.90

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1028.30~22.04.1

6.8.0-1028.30~22.04.1

ubuntu/linux-gke<5.15.0-1079.85

5.15.0-1079.85

ubuntu/linux-gkeop<5.15.0-1064.72

5.15.0-1064.72

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-58.60~22.04.1

6.8.0-58.60~22.04.1

ubuntu/linux-ibm<5.15.0-1074.77

5.15.0-1074.77

ubuntu/linux-ibm-6.8<6.8.0-1024.24~22.04.1

6.8.0-1024.24~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1077.83

5.15.0-1077.83

ubuntu/linux-kvm<5.15.0-1078.83

5.15.0-1078.83

ubuntu/linux-lowlatency<5.15.0-138.148

5.15.0-138.148

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-58.60.1~22.04.1

6.8.0-58.60.1~22.04.1

ubuntu/linux-nvidia<5.15.0-1076.77

5.15.0-1076.77

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1026.29~22.04.1

6.8.0-1026.29~22.04.1

ubuntu/linux-nvidia-tegra<5.15.0-1035.35

5.15.0-1035.35

ubuntu/linux-nvidia-tegra-igx<5.15.0-1023.23

5.15.0-1023.23

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1079.85

5.15.0-1079.85

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1024.25~22.04.1

6.8.0-1024.25~22.04.1

ubuntu/linux-raspi<5.15.0-1076.79

5.15.0-1076.79

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-58.60.1~22.04.1

6.8.0-58.60.1~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1046.50

5.15.0-1046.50

ubuntu/linux-bluefield<5.15.0-1064.66

5.15.0-1064.66

ubuntu/linux-intel-iot-realtime<5.15.0-1075.77

5.15.0-1075.77

ubuntu/linux-realtime<5.15.0-1082.91

5.15.0-1082.91

ubuntu/linux-realtime-6.8<6.8.1-1020.21~22.04.1

6.8.1-1020.21~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1082.89+fips1

5.15.0-1082.89+fips1

ubuntu/linux-azure-fips<5.15.0-1087.96+fips1

5.15.0-1087.96+fips1

ubuntu/linux-fips<5.15.0-138.148+fips1

5.15.0-138.148+fips1

ubuntu/linux-gcp-fips<5.15.0-1081.90+fips1

5.15.0-1081.90+fips1

ubuntu/linux<6.8.0-58.60

6.8.0-58.60

ubuntu/linux-aws<6.8.0-1027.29

6.8.0-1027.29

ubuntu/linux-azure<6.8.0-1027.32

6.8.0-1027.32

ubuntu/linux-azure-6.11<6.11.0-1013.13~24.04.1

6.11.0-1013.13~24.04.1

ubuntu/linux-azure-nvidia<6.8.0-1014.15

6.8.0-1014.15

ubuntu/linux-gcp<6.8.0-1028.30

6.8.0-1028.30

ubuntu/linux-gcp-6.11<6.11.0-1013.13~24.04.1

6.11.0-1013.13~24.04.1

ubuntu/linux-gke<6.8.0-1023.27

6.8.0-1023.27

ubuntu/linux-gkeop<6.8.0-1010.12

6.8.0-1010.12

ubuntu/linux-hwe-6.11<6.11.0-24.24~24.04.1

6.11.0-24.24~24.04.1

ubuntu/linux-ibm<6.8.0-1024.24

6.8.0-1024.24

ubuntu/linux-lowlatency<6.8.0-58.60.1

6.8.0-58.60.1

ubuntu/linux-lowlatency-hwe-6.11<6.11.0-1012.13~24.04.1

6.11.0-1012.13~24.04.1

ubuntu/linux-nvidia<6.8.0-1026.29

6.8.0-1026.29

ubuntu/linux-nvidia-6.11<6.11.0-1007.7

6.11.0-1007.7

ubuntu/linux-nvidia-lowlatency<6.8.0-1026.29.1

6.8.0-1026.29.1

ubuntu/linux-nvidia-tegra<6.8.0-1008.8

6.8.0-1008.8

ubuntu/linux-oem-6.11<6.11.0-1020.20

6.11.0-1020.20

ubuntu/linux-oem-6.8<6.8.0-1026.26

6.8.0-1026.26

ubuntu/linux-oracle<6.8.0-1024.25

6.8.0-1024.25

ubuntu/linux-raspi<6.8.0-1028.32

6.8.0-1028.32

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv<6.8.0-58.60.1

6.8.0-58.60.1

ubuntu/linux-xilinx<6.8.0-1017.18

6.8.0-1017.18

ubuntu/linux-raspi-realtime<6.8.0-2023.24

6.8.0-2023.24

ubuntu/linux-realtime<6.8.1-1020.21

6.8.1-1020.21

ubuntu/linux-fips<6.8.0-78.78+fips1

6.8.0-78.78+fips1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1082.89~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1087.96~20.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1081.90~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-138.148~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1074.77~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1077.83~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-138.148~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1079.85~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1077.81~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1039.39~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-138.148
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1082.89
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1027.29~22.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1087.96
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1027.32~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1087.96.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1081.90
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.30~22.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1079.85
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1064.72
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-58.60~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1074.77
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1024.24~22.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1077.83
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1078.83
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-138.148
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-58.60.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1076.77
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1026.29~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1035.35
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1023.23
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1079.85
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1024.25~22.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1076.79
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-58.60.1~22.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1046.50
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1064.66
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1075.77
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1082.91
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1020.21~22.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1082.89+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1087.96+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-138.148+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1081.90+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-58.60
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1027.29
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1027.32
Upgrade
Upgrade ubuntu/linux-azure-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1014.15
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.30
Upgrade
Upgrade ubuntu/linux-gcp-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1023.27
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1010.12
Upgrade
Upgrade ubuntu/linux-hwe-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-24.24~24.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1024.24
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-58.60.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1012.13~24.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1026.29
Upgrade
Upgrade ubuntu/linux-nvidia-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1007.7
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1026.29.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1008.8
Upgrade
Upgrade ubuntu/linux-oem-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1020.20
Upgrade
Upgrade ubuntu/linux-oem-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1026.26
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1024.25
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.32
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 6.8.0-58.60.1
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1017.18
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2023.24
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1020.21
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-78.78+fips1
Compensating control
Deny any ethtool operation on network devices once device unregistration or dismantling has started.

Event History

Feb 13, 2025

CVE Published

via OSV·03:15 PM

Data Sourced

via OSV·03:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required to trigger this issue?

A local attacker with low privileges must race network-device unregistration against an ethtool netlink operation that modifies channel counts, such as set_channels. No user interaction is required.

Which systems are exposed?