LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21951: bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock There are multiple places from where the recovery work gets scheduled asynchronously. Also, there are multiple places where the caller waits synchronously for the recovery to be completed. One such place is during the PM shutdown() callback. If the device is not alive during recovery_work, it will try to reset the device using pci_reset_function(). This function internally will take the device_lock() first before resetting the device. By this time, if the lock has already been acquired, then recovery_work will get stalled while waiting for the lock. And if the lock was already acquired by the caller which waits for the recovery_work to be completed, it will lead to deadlock. This is what happened on the X1E80100 CRD device when the device died before shutdown() callback. Driver core calls the driver's shutdown() callback while holding the device_lock() leading to deadlock. And this deadlock scenario can occur on other paths as well, like during the PM suspend() callback, where the driver core would hold the device_lock() before calling driver's suspend() callback. And if the recovery_work was already started, it could lead to deadlock. This is also observed on the X1E80100 CRD. So to fix both issues, use pci_try_reset_function() in recovery_work. This function first checks for the availability of the device_lock() before trying to reset the device. If the lock is available, it will acquire it and reset the device. Otherwise, it will return -EAGAIN. If that happens, recovery_work will fail with the error message "Recovery failed" as not much could be done.

MediumCVSS 5.5Not KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-21951 is a Linux kernel availability flaw. Under specific device recovery and power-management timing, the MHI PCI generic driver can deadlock during shutdown or suspend, leaving the system stuck rather than exposing or altering data.

Executive priority

Treat as a moderate operational resilience issue. It does not indicate data theft or privilege escalation, but affected systems may hang during shutdown or suspend. Patch through normal kernel maintenance, faster for fleets using relevant MHI PCI hardware.

Technical view

The issue is a CWE-667 locking problem in bus/mhi/host/pci_generic. Recovery work could call pci_reset_function() while another path already held device_lock() and waited for recovery, causing deadlock. The kernel fix uses pci_try_reset_function(), returning -EAGAIN if the lock is unavailable.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel builds with the MHI PCI generic driver and impacted hardware paths. The source specifically notes X1E80100 CRD observations, but the deadlock could occur through shutdown or suspend paths elsewhere.

Exploitation context

No active exploitation is cited, and KEV is false. CVSS is 5.5: local access, low complexity, low privileges, no user interaction, and high availability impact only. Sources describe a reliability deadlock, not public weaponization.

Researcher notes

The root issue is lock ordering around asynchronous recovery_work and synchronous PM callbacks. The fix avoids blocking on device_lock() during reset; if unavailable, recovery fails rather than deadlocking. Evidence is strongest for X1E80100 CRD and kernel stable branches listed in the sources.

Mitigation direction

  • Upgrade to a vendor kernel containing the referenced stable fixes.
  • Apply Debian LTS kernel updates where Debian LTS is in use.
  • Prioritize systems using MHI PCI generic devices or affected power-management paths.
  • Check distribution guidance if a fixed package is not yet available.
  • Avoid direct deployment shortcuts; use normal kernel update and reboot processes.

Validation and detection

  • Inventory Linux kernel versions against affected and fixed vendor releases.
  • Confirm the MHI PCI generic fix uses pci_try_reset_function().
  • Review logs for suspend, shutdown, recovery, or "Recovery failed" events.
  • Test shutdown and suspend behavior on representative impacted hardware.
  • Verify Debian LTS systems include the announced kernel update.
Prepared
Confidence
high
Sources
9

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-667: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-21951 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2025-21951Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7389337f0a78ea099c47f0af08f64f20c52ab4ba, 7389337f0a78ea099c47f0af08f64f20c52ab4ba, 7389337f0a78ea099c47f0af08f64f20c52ab4ba, 7389337f0a78ea099c47f0af08f64f20c52ab4ba, 7389337f0a78ea099c47f0af08f64f20c52ab4ba, 7389337f0a78ea099c47f0af08f64f20c52ab4baunaffected
LinuxLinux5.12, 0, 5.15.179, 6.1.131, 6.6.83, 6.12.19, 6.13.7, 6.14affected
Weakness

CWE details

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-667 · source CWE mapping

Improper Locking

Improper Locking represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.