← Back to CVE Explorer

CVE-2025-21767

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context The following bug report happened with a PREEMPT_RT kernel: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2012, name: kwatchdog preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 get_random_u32+0x4f/0x110 clocksource_verify_choose_cpus+0xab/0x1a0 clocksource_verify_percpu.part.0+0x6b/0x330 clocksource_watchdog_kthread+0x193/0x1a0 It is due to the fact that clocksource_verify_choose_cpus() is invoked with preemption disabled. This function invokes get_random_u32() to obtain random numbers for choosing CPUs. The batched_entropy_32 local lock and/or the base_crng.lock spinlock in driver/char/random.c will be acquired during the call. In PREEMPT_RT kernel, they are both sleeping locks and so cannot be acquired in atomic context. Fix this problem by using migrate_disable() to allow smp_processor_id() to be reliably used without introducing atomic context. preempt_disable() is then called after clocksource_verify_choose_cpus() but before the clocksource measurement is being run to avoid introducing unexpected latency.

Severity
MEDIUM
CVSS score
5.5 (v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-02-27 03:15:17.383000
Last modified
2026-11-05 21:17:42.467000
View original CVE JSON 
{
  "id": "CVE-2025-21767",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-02-27T03:15:17.383",
  "lastModified": "2026-11-05T21:17:42.467",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context\n\nThe following bug report happened with a PREEMPT_RT kernel:\n\n  BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\n  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2012, name: kwatchdog\n  preempt_count: 1, expected: 0\n  RCU nest depth: 0, expected: 0\n  get_random_u32+0x4f/0x110\n  clocksource_verify_choose_cpus+0xab/0x1a0\n  clocksource_verify_percpu.part.0+0x6b/0x330\n  clocksource_watchdog_kthread+0x193/0x1a0\n\nIt is due to the fact that clocksource_verify_choose_cpus() is invoked with\npreemption disabled.  This function invokes get_random_u32() to obtain\nrandom numbers for choosing CPUs.  The batched_entropy_32 local lock and/or\nthe base_crng.lock spinlock in driver/char/random.c will be acquired during\nthe call. In PREEMPT_RT kernel, they are both sleeping locks and so cannot\nbe acquired in atomic context.\n\nFix this problem by using migrate_disable() to allow smp_processor_id() to\nbe reliably used without introducing atomic context. preempt_disable() is\nthen called after clocksource_verify_choose_cpus() but before the\nclocksource measurement is being run to avoid introducing unexpected\nlatency."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: clocksource: Use migrants_disable() para evitar llamar a get_random_u32() en un contexto atómico El siguiente informe de error ocurrió con un kernel PREEMPT_RT: ERROR: función inactiva llamada desde un contexto no válido en kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2012, name: kwatchdog preempt_count: 1, expected: 0 Profundidad de anidamiento de RCU: 0, expected: 0 get_random_u32+0x4f/0x110 clocksource_verify_choose_cpus+0xab/0x1a0 clocksource_verify_percpu.part.0+0x6b/0x330 clocksource_watchdog_kthread+0x193/0x1a0 Esto se debe al hecho de que clocksource_verify_choose_cpus() se invoca con la preempción deshabilitada. Esta función invoca get_random_u32() para obtener números aleatorios para elegir las CPU. El bloqueo local batched_entropy_32 y/o el spinlock base_crng.lock en driver/char/random.c se adquirirán durante la llamada. En el kernel PREEMPT_RT, ambos son bloqueos inactivos y, por lo tanto, no se pueden adquirir en un contexto atómico. Solucione este problema utilizando migrants_disable() para permitir que smp_processor_id() se utilice de manera confiable sin introducir un contexto atómico. Luego, se llama a preempt_disable() después de clocksource_verify_choose_cpus() pero antes de que se ejecute la medición de la fuente de reloj para evitar introducir una latencia inesperada."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "kernel/time/clocksource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "d9b40ebd448e437ffbc65f013836f98252279a82",
              "lessThan": "d9c217fadfcff7a8df58567517d1e4253f3fd243",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7560c02bdffb7c52d1457fa551b9e745d4b9e754",
              "lessThan": "60f54f0d4ea530950549a8263e6fdd70a40490a4",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7560c02bdffb7c52d1457fa551b9e745d4b9e754",
              "lessThan": "852805b6cbdb69c298a8fc9fbe79994c95106e04",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7560c02bdffb7c52d1457fa551b9e745d4b9e754",
              "lessThan": "8783ceeee797d9aa9cfe150690fb9d0bac8cc459",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7560c02bdffb7c52d1457fa551b9e745d4b9e754",
              "lessThan": "cc3d79e7c806cb57d71c28a4a35e7d7fb3265faa",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7560c02bdffb7c52d1457fa551b9e745d4b9e754",
              "lessThan": "0fb534187d2355f6c8f995321e76d1ccd1262ac1",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7560c02bdffb7c52d1457fa551b9e745d4b9e754",
              "lessThan": "6bb05a33337b2c842373857b63de5c9bf1ae2a09",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "193e14e68e907b2a7a936a7726accbaa4df25a4d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "155d3c5d24ee13cafa6236b49fc02b240a511d59",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "5.10.50",
              "lessThan": "5.10.235",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.12.17",
              "lessThan": "5.13",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.13.2",
              "lessThan": "5.14",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "kernel/time/clocksource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.14",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.14",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.235",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.179",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.129",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.79",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.16",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.13.4",
              "lessThanOrEqual": "6.13.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.14",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    },
    {
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "V3.1.5",
              "lessThan": "*",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "V3.1.5",
              "lessThan": "*",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "V3.1.5",
              "lessThan": "*",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "V3.1.5",
              "lessThan": "*",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "0",
              "lessThan": "*",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "V3.1.5",
              "lessThan": "*",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-11-05T20:35:00.898450Z",
          "id": "CVE-2025-21767",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-667"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.10.50",
              "versionEndExcluding": "5.10.235",
              "matchCriteriaId": "B260687C-51FF-4C09-8771-ED58F13D241C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.12.17",
              "versionEndExcluding": "5.13",
              "matchCriteriaId": "CDB1D52E-21AB-4ECE-9119-6594F8FF3B3A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.13.2",
              "versionEndExcluding": "5.15.179",
              "matchCriteriaId": "11FDEE06-BDA7-4B56-904B-81B7552B92EB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.16",
              "versionEndExcluding": "6.1.129",
              "matchCriteriaId": "2DA5009C-C9B9-4A1D-9B96-78427E8F232C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.2",
              "versionEndExcluding": "6.6.79",
              "matchCriteriaId": "B16AADE5-B2FD-4C14-B4E4-85E8EDAFE775"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.7",
              "versionEndExcluding": "6.12.16",
              "matchCriteriaId": "13C8DB18-FC60-425F-84E5-3EDDEC61B2FC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.13",
              "versionEndExcluding": "6.13.4",
              "matchCriteriaId": "2A2093ED-74A9-43F9-AC72-50030F374EA4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0fb534187d2355f6c8f995321e76d1ccd1262ac1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/60f54f0d4ea530950549a8263e6fdd70a40490a4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/6bb05a33337b2c842373857b63de5c9bf1ae2a09",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/852805b6cbdb69c298a8fc9fbe79994c95106e04",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/8783ceeee797d9aa9cfe150690fb9d0bac8cc459",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/cc3d79e7c806cb57d71c28a4a35e7d7fb3265faa",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/d9c217fadfcff7a8df58567517d1e4253f3fd243",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html",
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html",
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
    }
  ]
}