CVE-2025-21767 – A race condition vulnerability in the Linux ker... (How to Fix)

📋 TL;DR

A race condition vulnerability in the Linux kernel's clocksource subsystem where get_random_u32() is called in atomic context on PREEMPT_RT kernels, potentially causing kernel panics or system instability. This affects Linux systems using PREEMPT_RT (Real-Time) kernels with specific configurations.

💻 Affected Systems

Products:

Linux Kernel

Versions: Specific versions with the vulnerable code (exact range depends on backports, but includes mainline kernels before the fix)

Operating Systems: Linux distributions using PREEMPT_RT kernels

Default Config Vulnerable: ✅ No

Notes: Only affects systems with PREEMPT_RT (Real-Time) kernel configuration enabled. Standard kernels are not vulnerable.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially disrupting critical real-time operations.

🟠

Likely Case

System instability or watchdog timeouts causing performance degradation in real-time applications.

🟢

If Mitigated

Minor performance impact during clocksource verification with proper kernel configuration.

🌐 Internet-Facing: LOW - This is a local kernel vulnerability requiring local access or specific kernel operations.

🏢 Internal Only: MEDIUM - Could affect critical real-time systems internally, but requires specific kernel configuration.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH - Requires specific kernel configuration and timing conditions

This is a race condition that requires specific kernel operations to trigger, making exploitation difficult.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel versions with commits 0fb534187d2355f6c8f995321e76d1ccd1262ac1 or later

Vendor Advisory: https://git.kernel.org/stable/c/0fb534187d2355f6c8f995321e76d1ccd1262ac1

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor
2. Rebuild kernel if using custom kernel
3. Reboot system to load new kernel

🔧 Temporary Workarounds

Disable PREEMPT_RT

linux

Switch to standard kernel configuration without real-time patches

Use standard kernel package instead of rt/preempt-rt variant

Disable clocksource watchdog

linux

Turn off clocksource verification that triggers the vulnerable code path

echo 0 > /sys/devices/system/clocksource/clocksource0/watchdog

🧯 If You Can't Patch

Disable PREEMPT_RT kernel configuration and use standard kernel
Monitor system logs for watchdog timeouts or kernel panics and have recovery procedures ready

🔍 How to Verify

Check if Vulnerable:

Check if using PREEMPT_RT kernel: uname -r | grep -i rt && check kernel version against patched versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commit: grep -q 'clocksource.*migrate_disable' /proc/kallsyms || check kernel source for fix

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages mentioning get_random_u32 in atomic context
Watchdog timeout errors in dmesg
BUG: sleeping function called from invalid context

Network Indicators:

None - this is a local kernel issue

SIEM Query:

source="kernel" AND ("get_random_u32" OR "atomic context" OR "clocksource_verify")

📊 Metadata

CVE ID: CVE-2025-21767

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-667

EPSS Score: 0.05% exploit probability (14.1th percentile)

Published: February 27, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-21767, you might also want to check these: