LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21831: PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1

In the Linux kernel, the following vulnerability has been resolved: PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 commit 9d26d3a8f1b0 ("PCI: Put PCIe ports into D3 during suspend") sets the policy that all PCIe ports are allowed to use D3. When the system is suspended if the port is not power manageable by the platform and won't be used for wakeup via a PME this sets up the policy for these ports to go into D3hot. This policy generally makes sense from an OSPM perspective but it leads to problems with wakeup from suspend on the TUXEDO Sirius 16 Gen 1 with a specific old BIOS. This manifests as a system hang. On the affected Device + BIOS combination, add a quirk for the root port of the problematic controller to ensure that these root ports are not put into D3hot at suspend. This patch is based on https://lore.kernel.org/linux-pci/20230708214457.1229-2-mario.limonciello@amd.com but with the added condition both in the documentation and in the code to apply only to the TUXEDO Sirius 16 Gen 1 with a specific old BIOS and only the affected root ports.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a narrow Linux kernel availability issue affecting suspend and resume on TUXEDO Sirius 16 Gen 1 systems with a specific old BIOS. The system can hang when waking from suspend because certain PCIe root ports are put into a low-power state. Evidence does not show remote compromise or active exploitation.

Executive priority

Treat as a low-priority, targeted reliability fix unless affected laptops are business-critical. The practical risk is downtime or disrupted work after suspend, not confirmed attacker activity. Patch through normal Linux maintenance once affected devices are identified.

Technical view

A prior Linux PCIe power-management policy allowed PCIe ports to enter D3 during suspend. On the affected TUXEDO Sirius 16 Gen 1 BIOS and root-port combination, this can place problematic root ports into D3hot and cause wake-from-suspend hangs. The kernel fix adds a hardware-specific quirk to avoid D3hot for those ports.

Likely exposure

Exposure appears limited to Linux systems on TUXEDO Sirius 16 Gen 1 hardware with the specific old BIOS and affected PCIe root ports. The source bundle does not identify the exact BIOS version, so fleet validation requires vendor or distribution guidance.

Exploitation context

The CVE is not listed as CISA KEV, and the provided sources do not report active exploitation. The impact described is operational availability during suspend/resume, not privilege escalation, data theft, or network-triggered compromise.

Researcher notes

The public record lacks CVSS, CWE, exact BIOS identifier, and exploit evidence. Analysis should stay scoped to the documented TUXEDO Sirius 16 Gen 1 old-BIOS condition and the root-port D3hot quirk. Do not generalize this to all Linux PCIe suspend behavior.

Mitigation direction

  • Update to a Linux kernel or distro package containing the referenced stable fix.
  • Check TUXEDO and distribution advisories for BIOS-specific guidance.
  • Avoid suspend on suspected affected laptops until patched or validated.
  • Prioritize remediation for users who depend on suspend/resume reliability.

Validation and detection

  • Inventory Linux endpoints for TUXEDO Sirius 16 Gen 1 hardware.
  • Record BIOS versions and compare with vendor or distro guidance.
  • Check kernel changelogs for the referenced PCI quirk commits.
  • In a controlled test, confirm suspend and resume no longer hangs.
  • Review system logs for repeated resume failures around PCIe power management.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21831 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9d26d3a8f1b0c442339a235f9508bdad8af91043, 9d26d3a8f1b0c442339a235f9508bdad8af91043, 9d26d3a8f1b0c442339a235f9508bdad8af91043, 9d26d3a8f1b0c442339a235f9508bdad8af91043unaffected
LinuxLinux4.8, 0, 6.6.78, 6.12.14, 6.13.3, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.