In the Linux kernel, the following vulnerability has been resolved:

clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context

The following bug report happened with a PREEMPT_RT kernel:

BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2012, name: kwatchdog
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
get_random_u32+0x4f/0x110
clocksource_verify_choose_cpus+0xab/0x1a0
clocksource_verify_percpu.part.0+0x6b/0x330
clocksource_watchdog_kthread+0x193/0x1a0

It is due to the fact that clocksource_verify_choose_cpus() is invoked with
preemption disabled. This function invokes get_random_u32() to obtain
random numbers for choosing CPUs. The batched_entropy_32 local lock and/or
the base_crng.lock spinlock in driver/char/random.c will be acquired during
the call. In PREEMPT_RT kernel, they are both sleeping locks and so cannot
be acquired in atomic context.

Fix this problem by using migrate_disable() to allow smp_processor_id() to
be reliably used without introducing atomic context. preempt_disable() is
then called after clocksource_verify_choose_cpus() but before the
clocksource measurement is being run to avoid introducing unexpected
latency.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00046.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
d9b40ebd448e437ffbc65f013836f98252279a82 affected
< d9c217fadfcff7a8df58567517d1e4253f3fd243
7560c02bdffb7c52d1457fa551b9e745d4b9e754 affected
< 60f54f0d4ea530950549a8263e6fdd70a40490a4
7560c02bdffb7c52d1457fa551b9e745d4b9e754 affected
< 852805b6cbdb69c298a8fc9fbe79994c95106e04
7560c02bdffb7c52d1457fa551b9e745d4b9e754 affected
< 8783ceeee797d9aa9cfe150690fb9d0bac8cc459
7560c02bdffb7c52d1457fa551b9e745d4b9e754 affected
< cc3d79e7c806cb57d71c28a4a35e7d7fb3265faa
7560c02bdffb7c52d1457fa551b9e745d4b9e754 affected
< 0fb534187d2355f6c8f995321e76d1ccd1262ac1
7560c02bdffb7c52d1457fa551b9e745d4b9e754 affected
< 6bb05a33337b2c842373857b63de5c9bf1ae2a09
193e14e68e907b2a7a936a7726accbaa4df25a4d affected
—
155d3c5d24ee13cafa6236b49fc02b240a511d59 affected
—
Linux Linux affected
Version Status Constraints
5.14 affected
—
0 unaffected
< 5.14
5.10.235 unaffected
≤ 5.10.*
5.15.179 unaffected
≤ 5.15.*
6.1.129 unaffected
≤ 6.1.*
6.6.79 unaffected
≤ 6.6.*
6.12.16 unaffected
≤ 6.12.*
6.13.4 unaffected
≤ 6.13.*
6.14 unaffected
≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*

No data.

No data.

Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4102-1 linux-6.1 security update
Debian DLA Debian DLA DLA-4178-1 linux security update
EUVD EUVD EUVD-2025-5160 In the Linux kernel, the following vulnerability has been resolved: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context The following bug report happened with a PREEMPT_RT kernel: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2012, name: kwatchdog preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 get_random_u32+0x4f/0x110 clocksource_verify_choose_cpus+0xab/0x1a0 clocksource_verify_percpu.part.0+0x6b/0x330 clocksource_watchdog_kthread+0x193/0x1a0 It is due to the fact that clocksource_verify_choose_cpus() is invoked with preemption disabled. This function invokes get_random_u32() to obtain random numbers for choosing CPUs. The batched_entropy_32 local lock and/or the base_crng.lock spinlock in driver/char/random.c will be acquired during the call. In PREEMPT_RT kernel, they are both sleeping locks and so cannot be acquired in atomic context. Fix this problem by using migrate_disable() to allow smp_processor_id() to be reliably used without introducing atomic context. preempt_disable() is then called after clocksource_verify_choose_cpus() but before the clocksource measurement is being run to avoid introducing unexpected latency.
Ubuntu USN Ubuntu USN USN-7510-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7510-2 Linux kernel (FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7510-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7510-4 Linux kernel (Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-7510-5 Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7510-6 Linux kernel (AWS FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7510-7 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7510-8 Linux kernel (AWS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7511-1 Linux kernel (GCP) vulnerabilities
Ubuntu USN Ubuntu USN USN-7511-2 Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7511-3 Linux kernel (GKE) vulnerabilities
Ubuntu USN Ubuntu USN USN-7512-1 Linux kernel (GCP) vulnerabilities
Ubuntu USN Ubuntu USN USN-7521-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7521-2 Linux kernel (AWS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7521-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7593-1 Linux kernel (HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-7602-1 Linux kernel (Xilinx ZynqMP) vulnerabilities
Ubuntu USN Ubuntu USN USN-7703-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7703-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7703-3 Linux kernel (Oracle) vulnerabilities
Ubuntu USN Ubuntu USN USN-7703-4 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7719-1 Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-7737-1 Linux kernel (Azure) vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0fb534187d2355f6c8f995321e76d1ccd1262ac1 cve-icon cve-icon
https://git.kernel.org/stable/c/60f54f0d4ea530950549a8263e6fdd70a40490a4 cve-icon cve-icon
https://git.kernel.org/stable/c/6bb05a33337b2c842373857b63de5c9bf1ae2a09 cve-icon cve-icon
https://git.kernel.org/stable/c/852805b6cbdb69c298a8fc9fbe79994c95106e04 cve-icon cve-icon
https://git.kernel.org/stable/c/8783ceeee797d9aa9cfe150690fb9d0bac8cc459 cve-icon cve-icon
https://git.kernel.org/stable/c/cc3d79e7c806cb57d71c28a4a35e7d7fb3265faa cve-icon cve-icon
https://git.kernel.org/stable/c/d9c217fadfcff7a8df58567517d1e4253f3fd243 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html cve-icon
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html cve-icon
https://lore.kernel.org/linux-cve-announce/2025022605-CVE-2025-21767-4c7f@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-21767 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-21767 cve-icon
History

Mon, 03 Nov 2025 20:30:00 +0000

Type Values Removed Values Added
References

Tue, 28 Oct 2025 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses CWE-667
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Sat, 03 May 2025 06:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Wed, 30 Apr 2025 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-662

Thu, 13 Mar 2025 12:30:00 +0000

Type Values Removed Values Added
References

Fri, 28 Feb 2025 02:00:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Thu, 27 Feb 2025 02:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context The following bug report happened with a PREEMPT_RT kernel: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2012, name: kwatchdog preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 get_random_u32+0x4f/0x110 clocksource_verify_choose_cpus+0xab/0x1a0 clocksource_verify_percpu.part.0+0x6b/0x330 clocksource_watchdog_kthread+0x193/0x1a0 It is due to the fact that clocksource_verify_choose_cpus() is invoked with preemption disabled. This function invokes get_random_u32() to obtain random numbers for choosing CPUs. The batched_entropy_32 local lock and/or the base_crng.lock spinlock in driver/char/random.c will be acquired during the call. In PREEMPT_RT kernel, they are both sleeping locks and so cannot be acquired in atomic context. Fix this problem by using migrate_disable() to allow smp_processor_id() to be reliably used without introducing atomic context. preempt_disable() is then called after clocksource_verify_choose_cpus() but before the clocksource measurement is being run to avoid introducing unexpected latency.
Title clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-11-03T19:37:24.318Z

Reserved: 2024-12-29T08:45:45.762Z

Link: CVE-2025-21767

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2025-02-27T03:15:17.383

Modified: 2025-11-03T20:17:16.923

Link: CVE-2025-21767

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-02-27T00:00:00Z

Links: CVE-2025-21767 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses