CVE-2025-21767

What it actually does

The flaw occurs because clocksource_verify_choose_cpus() disables preemption before calling get_random_u32(), causing acquisition of sleeping locks (batched_entropy_32 local lock and base_crng.lock) from atomic context on PREEMPT_RT kernels, triggering a sleeping-function-in-atomic-context BUG.

Why it matters to the business

Systems running PREEMPT_RT kernels may experience unexpected watchdog thread crashes or kernel instability during clocksource verification, leading to degraded availability on latency-sensitive real-time deployments.

How an attack unfolds

An attacker with local access triggers repeated clocksource_watchdog_kthread execution under preemption-disabled conditions to force the invalid sleeping lock acquisition and induce a kernel BUG, though no public weaponization or threat actor campaigns are associated with this specific issue.

How to fix it

Upgrade to a fixed kernel version such as 5.10.235 or the commit d9c217fadfcff7a8df58567517d1e4253f3fd243; rebuild and deploy the patched kernel on all PREEMPT_RT systems.

How to confirm the fix worked

Boot the updated kernel on a PREEMPT_RT configuration, confirm clocksource_watchdog_kthread completes without BUG reports in dmesg, and verify the migrate_disable() change is present in clocksource.c.

Typical attack path

1. Obtain local user access on a PREEMPT_RT Linux system
2. Wait for or induce clocksource_watchdog_kthread to run clocksource_verify_percpu
3. Trigger get_random_u32() while preemption is disabled
4. Cause acquisition of RT sleeping locks from atomic context
5. Induce kernel BUG and potential watchdog-induced instability

How to detect it

Search kernel logs (dmesg, journalctl) for BUG: sleeping function called from invalid context messages referencing get_random_u32 or clocksource_verify_choose_cpus; examine stack traces containing clocksource_watchdog_kthread on PREEMPT_RT systems.

What your security team should do

• Prioritize patching PREEMPT_RT production kernels within standard maintenance windows
• Add kernel version checks to configuration management and CI pipelines
• Monitor dmesg and kernel logs for sleeping-function-in-atomic-context messages on RT systems
• Test real-time workloads after upgrade to confirm latency characteristics remain acceptable