#VU106122 Improper locking in Linux kernel - CVE-2025-21871

Vulnerability identifier: #VU106122

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21871

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the optee_supp_thrd_req() function in drivers/tee/optee/supp.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/0180cf0373f84fff61b16f8c062553a13dd7cfca
https://git.kernel.org/stable/c/21234efe2a8474a6d2d01ea9573319de7858ce44
https://git.kernel.org/stable/c/3eb4911364c764572e9db4ab900a57689a54e8ce
https://git.kernel.org/stable/c/70b0d6b0a199c5a3ee6c72f5e61681ed6f759612
https://git.kernel.org/stable/c/c0a9a948159153be145f9471435695373904ee6d
https://git.kernel.org/stable/c/d61cc1a435e6894bfb0dd3370c6f765d2d12825d
https://git.kernel.org/stable/c/ec18520f5edc20a00c34a8c9fdd6507c355e880f
https://git.kernel.org/stable/c/fd9d2d6124c293e40797a080adf8a9c237efd8b8

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.