CVE-2025-21853: bpf: avoid holding freeze_mutex during mmap operation
In the Linux kernel, the following vulnerability has been resolved:
bpf: avoid holding freeze_mutex during mmap operation
We use map->freeze_mutex to prevent races between map_freeze() and
memory mapping BPF map contents with writable permissions. The way we
naively do this means we'll hold freeze_mutex for entire duration of all
the mm and VMA manipulations, which is completely unnecessary. This can
potentially also lead to deadlocks, as reported by syzbot in [0].
So, instead, hold freeze_mutex only during writeability checks, bump
(proactively) "write active" count for the map, unlock the mutex and
proceed with mmap logic. And only if something went wrong during mmap
logic, then undo that "write active" counter increment.
[0] https://lore.kernel.org/bpf/678dcbc9.050a0220.303755.0066.GAE@google.com/
Security readout for executives and security teams
Plain-English summary
CVE-2025-21853 is a Linux kernel BPF bug where locking during BPF map memory mapping could cause a deadlock. The reported impact is availability risk, not confirmed remote compromise. Public sources show kernel fixes and downstream advisories, but no CVSS score or KEV-listed exploitation.
Executive priority
Treat this as a kernel availability issue needing normal vulnerability management, with higher priority for shared, multi-tenant, or untrusted-workload Linux systems. Do not escalate as actively exploited based on current provided evidence.
Technical view
The kernel held map->freeze_mutex across broader mmap VMA and mm operations than needed. The fix limits the mutex to writeability checks, increments a write-active count before mmap processing, and unwinds that count on failure. The issue was reported by syzbot and fixed across stable kernel commits.
Likely exposure
Exposure is likely limited to Linux systems running affected kernel builds with BPF map mmap behavior present. The bundle lists affected Linux versions and stable fixes, but does not fully define exploit prerequisites, distribution package ranges, or product-specific Siemens impact.
Exploitation context
The source bundle states a potential deadlock and syzbot report. It does not cite active exploitation, proof-of-concept weaponization, KEV listing, remote attackability, privilege requirements, or data compromise.
Researcher notes
Evidence supports a BPF mmap locking flaw fixed by upstream stable commits. Severity, CVSS, CWE, and exploitation details are absent. Avoid assuming code execution or privilege escalation without additional vendor or researcher evidence.
Mitigation direction
Update Linux kernels to vendor-supported builds containing the referenced stable fixes.
Apply relevant Debian LTS updates where Debian LTS systems are in scope.
Review Siemens SSA-019113 for product-specific guidance before remediating Siemens environments.
If patch timing is constrained, follow vendor guidance for BPF exposure reduction.
Validation and detection
Inventory Linux kernel versions across servers, containers hosts, appliances, and embedded systems.
Map installed kernels against vendor advisories and fixed stable kernel releases.
Confirm Debian LTS package updates are installed where applicable.
Check Siemens advisory applicability for managed operational technology or appliance estates.
Document any systems requiring vendor-specific firmware or appliance updates.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-21853 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
2ADP providers
11Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Mar 12, 2025, 09:42 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.