ACK: [SRU][J][PATCH 0/1] CVE-2025-21812

[Edoardo Canepa]

Acked-by: Edoardo Canepa <edoardo.canepa at canonical.com>

On 9/9/26 13:53, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2025-21812
>
> [ Impact ]
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> ax25: rcu protect dev->ax25_ptr
>
> syzbot found a lockdep issue [1].
>
> We should remove ax25 RTNL dependency in ax25_setsockopt()
>
> This should also fix a variety of possible UAF in ax25.
>
> [1]
>
> WARNING: possible circular locking dependency detected
> 6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0 Not tainted
> ------------------------------------------------------ syz.5.1818/12806 is
> trying to acquire lock: ffffffff8fcb3988 (rtnl_mutex){+.+.}-{4:4}, at:
> ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680
>
> but task is already holding lock: ffff8880617ac258
> (sk_lock-AF_AX25){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1618 [inline]
> ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: ax25_setsockopt+0x209/0xe90
> net/ax25/af_ax25.c:574
>
> which lock already depends on the new lock.
>
> the existing dependency chain (in reverse order) is:
>
> -> #1 (sk_lock-AF_AX25){+.+.}-{0:0}: lock_acquire+0x1ed/0x550
> kernel/locking/lockdep.c:5849 lock_sock_nested+0x48/0x100 net/core/sock.c:3642
> lock_sock include/net/sock.h:1618 [inline] ax25_kill_by_device
> net/ax25/af_ax25.c:101 [inline] ax25_device_event+0x24d/0x580
> net/ax25/af_ax25.c:146 notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85
> __dev_notify_flags+0x207/0x400 dev_change_flags+0xf0/0x1a0 net/core/dev.c:9026
> dev_ifsioc+0x7c8/0xe70 net/core/dev_ioctl.c:563 dev_ioctl+0x719/0x1340
> net/core/dev_ioctl.c:820 sock_do_ioctl+0x240/0x460 net/socket.c:1234
> sock_ioctl+0x626/0x8e0 net/socket.c:1339 vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
> do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230
> arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> -> #0 (rtnl_mutex){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3161
> [inline] check_prevs_add kernel/locking/lockdep.c:3280 [inline]
> validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
> __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
> lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __mutex_lock_common
> kernel/locking/mutex.c:585 [inline] __mutex_lock+0x1ac/0xee0
> kernel/locking/mutex.c:735 ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680
> do_sock_setsockopt+0x3af/0x720 net/socket.c:2324 __sys_setsockopt
> net/socket.c:2349 [inline] __do_sys_setsockopt net/socket.c:2355 [inline]
> __se_sys_setsockopt net/socket.c:2352 [inline] __x64_sys_setsockopt+0x1ee/0x280
> net/socket.c:2352 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> other info that might help us debug this:
>
> Possible unsafe locking scenario:
>
> CPU0 CPU1 ---- ---- lock(sk_lock-AF_AX25); lock(rtnl_mutex);
> lock(sk_lock-AF_AX25); lock(rtnl_mutex);
>
> *** DEADLOCK ***
>
> 1 lock held by syz.5.1818/12806: #0: ffff8880617ac258
> (sk_lock-AF_AX25){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1618 [inline]
> #0: ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at:
> ax25_setsockopt+0x209/0xe90 net/ax25/af_ax25.c:574
>
> stack backtrace: CPU: 1 UID: 0 PID: 12806 Comm: syz.5.1818 Not tainted
> 6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0 Hardware name: Google Google
> Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK>
> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360
> lib/dump_stack.c:120 print_circular_bug+0x13a/0x1b0
> kernel/locking/lockdep.c:2074 check_noncircular+0x36a/0x4a0
> kernel/locking/lockdep.c:2206 check_prev_add kernel/locking/lockdep.c:3161
> [inline] check_prevs_add kernel/lockin ---truncated---
>
> [ Fix ]
>
> jammy/linux: backported from 95fc45d1dea8
>
> [ Test Plan ]
>
> Build and boot tested.
>
> [ Where Problems Could Occur ]
>
> A bad fix would affect systems that use the AX.25 amateur radio packet
> protocol, since the change reworks how the per-device ax25_ptr is accessed
> under RCU and how locking is taken in the AX.25 setsockopt path; regressions
> would most likely surface as AX.25 socket option failures, connectivity
> problems, or crashes when AX.25 network devices are brought up or down.
> Systems that do not load the AX.25 subsystem or configure AX.25 interfaces
> are not affected by this change.
>
> [ Other Info ]
>
> Kybele flow-v11-22-gf3c7ff80. Reference: ae514cf2/v1
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260914/3d0e07de/attachment.sig>