In the Linux kernel, the following vulnerability has been resolved: block: fix queue freeze vs limits lock order in sysfs store methods… (CVE-2025-21807)
A deadlock vulnerability in the Linux kernel block subsystem was resolved. The issue involved improper lock ordering between queue freeze and queue limits locks in sysfs store methods, potentially causing an ABBA deadlock when modifying device queue limits. The fix changes the order of locking and queue freezing to prevent this deadlock condition.
AI Analysis
Technical Summary
CVE-2025-21807 addresses a deadlock vulnerability in the Linux kernel's block device queue management. The function queue_attr_store() previously froze the device queue before acquiring the queue limits lock, which could cause an ABBA deadlock if a device driver, such as SCSI sd, attempted to revalidate queue limits while the queue was frozen. The patch modifies the locking order by deferring queue freezing until after the queue limits lock is acquired, using queue_limits_commit_update_frozen, and removes unnecessary sysfs locking to avoid nested locks. This change prevents the deadlock scenario during sysfs attribute store operations that modify queue limits.
Potential Impact
This vulnerability can cause a denial of service by deadlocking the device queue management subsystem in the Linux kernel, leading to system hangs or unresponsiveness related to block device operations. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should update to a kernel version that includes this patch. Since no specific affected versions or patch links are provided, check the official Linux kernel advisories or vendor updates for the fixed kernel versions and apply the update accordingly.
In the Linux kernel, the following vulnerability has been resolved: block: fix queue freeze vs limits lock order in sysfs store methods… (CVE-2025-21807)
Description
A deadlock vulnerability in the Linux kernel block subsystem was resolved. The issue involved improper lock ordering between queue freeze and queue limits locks in sysfs store methods, potentially causing an ABBA deadlock when modifying device queue limits. The fix changes the order of locking and queue freezing to prevent this deadlock condition.
CVSS v3.1
Score 5.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-21807 addresses a deadlock vulnerability in the Linux kernel's block device queue management. The function queue_attr_store() previously froze the device queue before acquiring the queue limits lock, which could cause an ABBA deadlock if a device driver, such as SCSI sd, attempted to revalidate queue limits while the queue was frozen. The patch modifies the locking order by deferring queue freezing until after the queue limits lock is acquired, using queue_limits_commit_update_frozen, and removes unnecessary sysfs locking to avoid nested locks. This change prevents the deadlock scenario during sysfs attribute store operations that modify queue limits.
Potential Impact
This vulnerability can cause a denial of service by deadlocking the device queue management subsystem in the Linux kernel, leading to system hangs or unresponsiveness related to block device operations. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should update to a kernel version that includes this patch. Since no specific affected versions or patch links are provided, check the official Linux kernel advisories or vendor updates for the fixed kernel versions and apply the update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-cp43-x3rr-gwcc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-21807"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a5bd3172a4a8d5989284cc7
Added to database: 07/18/2026, 19:25:11 UTC
Last enriched: 07/18/2026, 19:25:57 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.