LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21853: bpf: avoid holding freeze_mutex during mmap operation

In the Linux kernel, the following vulnerability has been resolved: bpf: avoid holding freeze_mutex during mmap operation We use map->freeze_mutex to prevent races between map_freeze() and memory mapping BPF map contents with writable permissions. The way we naively do this means we'll hold freeze_mutex for entire duration of all the mm and VMA manipulations, which is completely unnecessary. This can potentially also lead to deadlocks, as reported by syzbot in [0]. So, instead, hold freeze_mutex only during writeability checks, bump (proactively) "write active" count for the map, unlock the mutex and proceed with mmap logic. And only if something went wrong during mmap logic, then undo that "write active" counter increment. [0] https://lore.kernel.org/bpf/678dcbc9.050a0220.303755.0066.GAE@google.com/

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-21853 is a Linux kernel BPF bug where locking during BPF map memory mapping could cause a deadlock. The reported impact is availability risk, not confirmed remote compromise. Public sources show kernel fixes and downstream advisories, but no CVSS score or KEV-listed exploitation.

Executive priority

Treat this as a kernel availability issue needing normal vulnerability management, with higher priority for shared, multi-tenant, or untrusted-workload Linux systems. Do not escalate as actively exploited based on current provided evidence.

Technical view

The kernel held map->freeze_mutex across broader mmap VMA and mm operations than needed. The fix limits the mutex to writeability checks, increments a write-active count before mmap processing, and unwinds that count on failure. The issue was reported by syzbot and fixed across stable kernel commits.

Likely exposure

Exposure is likely limited to Linux systems running affected kernel builds with BPF map mmap behavior present. The bundle lists affected Linux versions and stable fixes, but does not fully define exploit prerequisites, distribution package ranges, or product-specific Siemens impact.

Exploitation context

The source bundle states a potential deadlock and syzbot report. It does not cite active exploitation, proof-of-concept weaponization, KEV listing, remote attackability, privilege requirements, or data compromise.

Researcher notes

Evidence supports a BPF mmap locking flaw fixed by upstream stable commits. Severity, CVSS, CWE, and exploitation details are absent. Avoid assuming code execution or privilege escalation without additional vendor or researcher evidence.

Mitigation direction

  • Update Linux kernels to vendor-supported builds containing the referenced stable fixes.
  • Apply relevant Debian LTS updates where Debian LTS systems are in scope.
  • Review Siemens SSA-019113 for product-specific guidance before remediating Siemens environments.
  • If patch timing is constrained, follow vendor guidance for BPF exposure reduction.

Validation and detection

  • Inventory Linux kernel versions across servers, containers hosts, appliances, and embedded systems.
  • Map installed kernels against vendor advisories and fixed stable kernel releases.
  • Confirm Debian LTS package updates are installed where applicable.
  • Check Siemens advisory applicability for managed operational technology or appliance estates.
  • Document any systems requiring vendor-specific firmware or appliance updates.
Prepared
Confidence
medium
Sources
12

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21853 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
11Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
siemens-SADPADP container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxfc9702273e2edb90400a34b3be76f7b08fa3344b, fc9702273e2edb90400a34b3be76f7b08fa3344b, fc9702273e2edb90400a34b3be76f7b08fa3344b, fc9702273e2edb90400a34b3be76f7b08fa3344b, fc9702273e2edb90400a34b3be76f7b08fa3344b, fc9702273e2edb90400a34b3be76f7b08fa3344b, fc9702273e2edb90400a34b3be76f7b08fa3344bunaffected
LinuxLinux5.5, 0, 5.10.237, 5.15.181, 6.1.135, 6.6.80, 6.12.17, 6.13.5, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.