CVE-2025-21728: linux kernel — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Send signals asynchronously if !preemptible BPF programs can execute in all kinds of contexts and when a program running in a non-preemptible context uses the bpf_send_signal() kfunc, it will cause issues because this kfunc can sleep. Change `irqs_disabled()` to `!preemptible()`.

Is your site exposed to CVE-2025-21728?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
linux	linux_kernel	5.4.33 — 5.4.291
linux	linux_kernel	5.5.18 — 5.6
linux	linux_kernel	5.6.1 — 5.10.235
linux	linux_kernel	5.11 — 5.15.179
linux	linux_kernel	5.16 — 6.1.129
linux	linux_kernel	6.2 — 6.6.76
linux	linux_kernel	6.7 — 6.12.13
linux	linux_kernel	6.13 — 6.13.2
linux	linux_kernel	All

References

Advisories & Patches

https://git.kernel.org/stable/c/092fc76b7ab4163e008f9cde596a58dad2108260 https://git.kernel.org/stable/c/78b97783496b454435639937db3303e900a24d3f https://git.kernel.org/stable/c/87c544108b612512b254c8f79aa5c0a8546e2cc4 https://git.kernel.org/stable/c/be42a09fe898635b0093c0c8dac1bfabe225c240 https://git.kernel.org/stable/c/ce51eab2070e295d298f42a2f1db269cd1b56d55 https://git.kernel.org/stable/c/e306eaaa3d78b462db5f5b11e0171f9d2b6ca3f4 https://git.kernel.org/stable/c/eeef8e65041a031bd8a747a392c14b76a123a12c https://git.kernel.org/stable/c/feba1308bc5e8e04cee751d39fae8a9b407a9034

Other References

https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html https://cert-portal.siemens.com/productcert/html/ssa-082556.html https://cert-portal.siemens.com/productcert/html/ssa-265688.html

Frequently Asked Questions

What is CVE-2025-21728? +

In the Linux kernel, the following vulnerability has been resolved: bpf: Send signals asynchronously if !preemptible BPF programs can execute in all kinds of contexts and when a program running in a non-preemptible context uses the bpf_send_signal() kfunc, it will cause issues because this kfunc can sleep. Change `irqs_disabled()` to `!preemptible()`. It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2025-21728? +

CVE-2025-21728 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-21728? +

CVE-2025-21728 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-21728? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-9588 10.0

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. …

CVE-2025-57870 10.0

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This …

CVE-2026-48286 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result …

CVE-2026-13782 10.0

Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer …

CVE-2026-48303 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result …

CVE-2025-34028 10.0

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when …

CVE-2025-21728