CVE-2025-21951

Summary

CVE-2025-21951 is a vulnerability affecting the Linux kernel where a deadlock can occur during device recovery. In specific scenarios, such as during the PM shutdown callback or PM suspend callback, the device_lock() is held by the driver core before calling the recovery work. Subsequently, if the recovery_work is already in progress, a deadlock results. To mitigate this issue, using pci_try_reset_function() in the recovery_work is recommended. This function attempts to reset the device while checking for the availability of the device_lock(). If the lock is unavailable, it returns an error and lets the recovery_work fail gracefully. This approach avoids potential deadlock situations.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.