{"id":"DEBIAN-CVE-2025-22111","details":"In the Linux kernel, the following vulnerability has been resolved:  net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.  SIOCBRDELIF is passed to dev_ioctl() first and later forwarded to br_ioctl_call(), which causes unnecessary RTNL dance and the splat below [0] under RTNL pressure.  Let's say Thread A is trying to detach a device from a bridge and Thread B is trying to remove the bridge.  In dev_ioctl(), Thread A bumps the bridge device's refcnt by netdev_hold() and releases RTNL because the following br_ioctl_call() also re-acquires RTNL.  In the race window, Thread B could acquire RTNL and try to remove the bridge device.  Then, rtnl_unlock() by Thread B will release RTNL and wait for netdev_put() by Thread A.  Thread A, however, must hold RTNL after the unlock in dev_ifsioc(), which may take long under RTNL pressure, resulting in the splat by Thread B.    Thread A (SIOCBRDELIF)           Thread B (SIOCBRDELBR)   ----------------------           ----------------------   sock_ioctl                       sock_ioctl   `- sock_do_ioctl                 `- br_ioctl_call      `- dev_ioctl                     `- br_ioctl_stub         |- rtnl_lock                     |         |- dev_ifsioc                    '         '  |- dev = __dev_get_by_name(...)            |- netdev_hold(dev, ...)      .        /   |- rtnl_unlock  ------.       |        |   |- br_ioctl_call       `---\u003e  |- rtnl_lock   Race |   |  `- br_ioctl_stub           |- br_del_bridge   Window   |     |                       |  |- dev = __dev_get_by_name(...)        |   |     |  May take long        |  `- br_dev_delete(dev, ...)        |   |     |  under RTNL pressure  |     `- unregister_netdevice_queue(dev, ...)        |   |     |               |       `- rtnl_unlock        \\   |     |- rtnl_lock  \u003c-'          `- netdev_run_todo            |     |- ...                        `- netdev_run_todo            |     `- rtnl_unlock                   |- __rtnl_unlock            |                                      |- netdev_wait_allrefs_any            |- netdev_put(dev, ...)  \u003c----------------'                                                 Wait refcnt decrement                                                 and log splat below  To avoid blocking SIOCBRDELBR unnecessarily, let's not call dev_ioctl() for SIOCBRADDIF and SIOCBRDELIF.  In the dev_ioctl() path, we do the following:    1. Copy struct ifreq by get_user_ifreq in sock_do_ioctl()   2. Check CAP_NET_ADMIN in dev_ioctl()   3. Call dev_load() in dev_ioctl()   4. Fetch the master dev from ifr.ifr_name in dev_ifsioc()  3. can be done by request_module() in br_ioctl_call(), so we move 1., 2., and 4. to br_ioctl_stub().  Note that 2. is also checked later in add_del_if(), but it's better performed before RTNL.  SIOCBRADDIF and SIOCBRDELIF have been processed in dev_ioctl() since the pre-git era, and there seems to be no specific reason to process them there.  [0]: unregister_netdevice: waiting for wpan3 to become free. Usage count = 2 ref_tracker: wpan3@ffff8880662d8608 has 1/1 users at      __netdev_tracker_alloc include/linux/netdevice.h:4282 [inline]      netdev_hold include/linux/netdevice.h:4311 [inline]      dev_ifsioc+0xc6a/0x1160 net/core/dev_ioctl.c:624      dev_ioctl+0x255/0x10c0 net/core/dev_ioctl.c:826      sock_do_ioctl+0x1ca/0x260 net/socket.c:1213      sock_ioctl+0x23a/0x6c0 net/socket.c:1318      vfs_ioctl fs/ioctl.c:51 [inline]      __do_sys_ioctl fs/ioctl.c:906 [inline]      __se_sys_ioctl fs/ioctl.c:892 [inline]      __x64_sys_ioctl+0x1a4/0x210 fs/ioctl.c:892      do_syscall_x64 arch/x86/entry/common.c:52 [inline]      do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83      entry_SYSCALL_64_after_hwframe+0x77/0x7f","modified":"2026-09-01T16:06:10.918206794Z","published":"2025-04-16T15:16:05.347Z","upstream":["CVE-2025-22111"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-22111"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.162-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.153-1","6.1.158-1","6.1.159-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-22111.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.69-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1~bpo12+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-22111.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16.3-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.3-1~bpo13+1","6.16~rc7-1~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-22111.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}