DEBIAN-CVE-2025-21897

Source
https://security-tracker.debian.org/tracker/CVE-2025-21897
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21897.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2025-21897
Upstream
Published
2025-04-01T16:15:20.083Z
Modified
2025-11-19T01:08:49.510501Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix picktaskscx() picking non-queued tasks when it's called without balance() a6250aa251ea ("schedext: Handle cases where picktaskscx() is called without preceding balancescx()") added a workaround to handle the cases where picktaskscx() is called without prececing balancescx() which is due to a fair class bug where picktaksfair() may return NULL after a true return from balancefair(). The workaround detects when picktaskscx() is called without preceding balancescx() and emulates SCXRQBALKEEP and triggers kicking to avoid stalling. Unfortunately, the workaround code was testing whether @prev was on SCX to decide whether to keep the task running. This is incorrect as the task may be on SCX but no longer runnable. This could lead to a non-runnable task to be returned from picktaskscx() which cause interesting confusions and failures. e.g. A common failure mode is the task ending up with (!onrq && oncpu) state which can cause potential wakers to busy loop, which can easily lead to deadlocks. Fix it by testing whether @prev has SCXTASKQUEUED set. This makes @prevon_scx only used in one place. Open code the usage and improve the comment while at it.

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.12.19-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:14 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.12.19-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}