CVE-2025-21694

What it actually does

The flaw allows softlockups during __read_vmcore execution in memory-constrained kdump environments by lacking sufficient rescheduling points in the second loop, which can block RCU memory freeing and stall the crashdump process.

Why it matters to the business

Organizations may experience failed or delayed kernel crash dumps on affected Linux systems under memory pressure, increasing downtime during incidents and complicating root-cause analysis for production failures.

How an attack unfolds

An attacker with local access triggers repeated reads of /proc/vmcore in a low-memory kdump context; without cond_resched calls the loop spins long enough to trigger softlockups that interfere with RCU and hang the dump, preventing successful crash collection.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.4.290 or commit 84c4ed15626574c9ac6c1039ba9c137a77bcc7f2 (or later stable releases containing the cond_resched addition). Rebuild and redeploy initramfs images used for kdump after the update.

How to confirm the fix worked

Confirm the running kernel reports the patch commit or version 5.4.290+, then reproduce a kdump under memory pressure and verify absence of softlockup warnings in the dump logs.

Typical attack path

1. Obtain local user or process execution on a Linux system configured for kdump
2. Force the system into a memory-constrained state matching kdump image limits
3. Trigger repeated access to vmcore data paths that exercise the second loop in __read_vmcore
4. Observe softlockup messages and subsequent stall of RCU and crashdump completion

How to detect it

Review kernel logs and kdump output for repeated softlockup messages referencing __read_vmcore; inspect audit or process accounting for local processes repeatedly accessing /proc/vmcore shortly before dump failures.

What your security team should do

• Prioritize kernel upgrades on systems that rely on kdump for production troubleshooting
• Test kdump functionality after applying fixes in staging environments that mimic memory-constrained conditions
• Monitor EPSS and threat actor reports for any rise in local DoS techniques targeting kernel procfs paths