CVE-2025-21651

What it actually does

Race condition in hns3 driver allowing misc IRQ to fire before service task initialization, triggering invalid delayed work scheduling and kernel warnings.

Why it matters to the business

Systems using affected Huawei network adapters may experience boot-time warnings or instability until kernel is updated, increasing operational overhead for hardware-dependent environments.

How an attack unfolds

An attacker with local access or control over interrupt timing on hns3 hardware can trigger the IRQ during the brief window after IRQ request but before service task setup, causing the observed warning path; listed threat actors appear mismatched to this low-severity race.

How to fix it

Update Linux kernel to commit bcf430d3bb5525fc89a92a0c451c725ba1aa4306 or later stable release; ensure hns3 driver no longer auto-enables misc vector on IRQ request.

How to confirm the fix worked

Confirm kernel contains the referenced commit; test IRQ registration sequence under load and verify absence of the mod_delayed_work_on warning from hclge_misc_irq_handle.

Typical attack path

1. Identify system with hns3 NIC and vulnerable kernel
2. Time or induce interrupt during misc vector enable window
3. Observe resulting call trace and warning in logs

How to detect it

Search kernel logs for hclge_misc_irq_handle and __queue_delayed_work traces around boot or CPU idle events; correlate with hns3 driver load timestamps.

What your security team should do

• Prioritize kernel upgrade on all systems with hns3 hardware
• Monitor boot and idle logs for hclge_errhand_task_schedule warnings
• Review EPSS trend and schedule patching within standard change windows