CVE-2025-21853

bpf: avoid holding freeze_mutex during mmap operation

Published Mar 12, 2025 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: avoid holding freeze_mutex during mmap operation

We use map->freeze_mutex to prevent races between map_freeze() and
memory mapping BPF map contents with writable permissions. The way we
naively do this means we'll hold freeze_mutex for entire duration of all
the mm and VMA manipulations, which is completely unnecessary. This can
potentially also lead to deadlocks, as reported by syzbot in [0].

So, instead, hold freeze_mutex only during writeability checks, bump
(proactively) "write active" count for the map, unlock the mutex and
proceed with mmap logic. And only if something went wrong during mmap
logic, then undo that "write active" counter increment.

[0] https://lore.kernel.org/bpf/678dcbc9.050a0220.303755.0066.GAE@google.com/

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fc9702273e2edb90400a34b3be76f7b08fa3344b`	affected	< 2ce31c97c219b4fe797749f950274f246eb88c49
`fc9702273e2edb90400a34b3be76f7b08fa3344b`	affected	< 0d90d9e154144a3a80e9fc0eb9b21b7fc990f68f
`fc9702273e2edb90400a34b3be76f7b08fa3344b`	affected	< 4759acbd44d24a69b7b14848012ec4201d6c5501
`fc9702273e2edb90400a34b3be76f7b08fa3344b`	affected	< 29cfda62ab4d92ab94123813db49ab76c1e61b29
`fc9702273e2edb90400a34b3be76f7b08fa3344b`	affected	< d95607a5f2f9bb08194c9deaf4a5f3e8ba59a9d4
`fc9702273e2edb90400a34b3be76f7b08fa3344b`	affected	< 271e49f8a58edba65bc2b1250a0abaa98c4bfdbe
`fc9702273e2edb90400a34b3be76f7b08fa3344b`	affected	< bc27c52eea189e8f7492d40739b7746d67b65beb

Linux

affected

Version	Status	Constraints
`5.5`	affected	—
`0`	unaffected	< 5.5
`5.10.237`	unaffected	≤ 5.10.*
`5.15.181`	unaffected	≤ 5.15.*
`6.1.135`	unaffected	≤ 6.1.*
`6.6.80`	unaffected	≤ 6.6.*
`6.12.17`	unaffected	≤ 6.12.*
`6.13.5`	unaffected	≤ 6.13.*
`6.14`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.14:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.14:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.14:rc3::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4178-1	linux security update
Debian DLA	DLA-4193-1	linux-6.1 security update
Debian DSA	DSA-5907-1	linux security update
EUVD	EUVD-2025-6392	In the Linux kernel, the following vulnerability has been resolved: bpf: avoid holding freeze_mutex during mmap operation We use map->freeze_mutex to prevent races between map_freeze() and memory mapping BPF map contents with writable permissions. The way we naively do this means we'll hold freeze_mutex for entire duration of all the mm and VMA manipulations, which is completely unnecessary. This can potentially also lead to deadlocks, as reported by syzbot in [0]. So, instead, hold freeze_mutex only during writeability checks, bump (proactively) "write active" count for the map, unlock the mutex and proceed with mmap logic. And only if something went wrong during mmap logic, then undo that "write active" counter increment. [0] https://lore.kernel.org/bpf/678dcbc9.050a0220.303755.0066.GAE@google.com/
Ubuntu USN	USN-7521-1	Linux kernel vulnerabilities
Ubuntu USN	USN-7521-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-7521-3	Linux kernel vulnerabilities
Ubuntu USN	USN-7654-1	Linux kernel vulnerabilities
Ubuntu USN	USN-7654-2	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-7654-3	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-7654-4	Linux kernel (KVM) vulnerabilities
Ubuntu USN	USN-7654-5	Linux kernel (Xilinx ZynqMP) vulnerabilities
Ubuntu USN	USN-7655-1	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-7686-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-7703-1	Linux kernel vulnerabilities
Ubuntu USN	USN-7703-2	Linux kernel vulnerabilities
Ubuntu USN	USN-7703-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-7703-4	Linux kernel vulnerabilities
Ubuntu USN	USN-7711-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-7712-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-7712-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-7719-1	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-7737-1	Linux kernel (Azure) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.248% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://git.kernel.org/stable/c/0d90d9e154144a3a80e9fc0eb9b21b7fc990f68f
https://git.kernel.org/stable/c/271e49f8a58edba65bc2b1250a0abaa98c4bfdbe
https://git.kernel.org/stable/c/29cfda62ab4d92ab94123813db49ab76c1e61b29
https://git.kernel.org/stable/c/2ce31c97c219b4fe797749f950274f246eb88c49
https://git.kernel.org/stable/c/4759acbd44d24a69b7b14848012ec4201d6c5501
https://git.kernel.org/stable/c/bc27c52eea189e8f7492d40739b7746d67b65beb
https://git.kernel.org/stable/c/d95607a5f2f9bb08194c9deaf4a5f3e8ba59a9d4
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
https://lore.kernel.org/linux-cve-announce/2025031214-CVE-2025-21853-cf76@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-21853
https://www.cve.org/CVERecord?id=CVE-2025-21853

History

Nov 6, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 15, 2026 2:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-457936.html

Nov 3, 2025 8:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Jul 12, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00031}`	epss `{'score': 0.00043}`

May 2, 2025 6:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0d90d9e154144a3a80e9fc0eb9b21b7fc990f68f https://git.kernel.org/stable/c/2ce31c97c219b4fe797749f950274f246eb88c49

Apr 25, 2025 10:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/4759acbd44d24a69b7b14848012ec4201d6c5501

Apr 2, 2025 3:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-833

Mar 14, 2025 2:30 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025031214-CVE-2025-21853-cf76@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2025-21853 https://www.cve.org/CVERecord?id=CVE-2025-21853
Metrics	threat_severity `None`	threat_severity `Moderate`

Mar 13, 2025 5:00 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:::::::: cpe:2.3:o:linux:linux_kernel:6.14:rc1:::::: cpe:2.3:o:linux:linux_kernel:6.14:rc2:::::: cpe:2.3:o:linux:linux_kernel:6.14:rc3::::::
Vendors & Products		Linux Linux linux Kernel
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Mar 12, 2025 9:45 AM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bpf: avoid holding freeze_mutex during mmap operation We use map->freeze_mutex to prevent races between map_freeze() and memory mapping BPF map contents with writable permissions. The way we naively do this means we'll hold freeze_mutex for entire duration of all the mm and VMA manipulations, which is completely unnecessary. This can potentially also lead to deadlocks, as reported by syzbot in [0]. So, instead, hold freeze_mutex only during writeability checks, bump (proactively) "write active" count for the map, unlock the mutex and proceed with mmap logic. And only if something went wrong during mmap logic, then undo that "write active" counter increment. [0] https://lore.kernel.org/bpf/678dcbc9.050a0220.303755.0066.GAE@google.com/
Title		bpf: avoid holding freeze_mutex during mmap operation
References		https://git.kernel.org/stable/c/271e49f8a58edba65bc2b1250a0abaa98c4bfdbe https://git.kernel.org/stable/c/29cfda62ab4d92ab94123813db49ab76c1e61b29 https://git.kernel.org/stable/c/bc27c52eea189e8f7492d40739b7746d67b65beb https://git.kernel.org/stable/c/d95607a5f2f9bb08194c9deaf4a5f3e8ba59a9d4