https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 21:51:26 +0000 https://vulnerability.circl.lu/vuln/cve-2025-22111 <p><strong>Affected:</strong> Linux, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.</p> <p>SIOCBRDELIF is passed to dev_ioctl() first and later forwarded to br_ioctl_call(), which causes unnecessary RTNL dance and the splat below [0] under RTNL pressure.</p> <p>Let&#39;s say Thread A is trying to detach a device from a bridge and Thread B is trying to remove the bridge.</p> <p>In dev_ioctl(), Thread A bumps the bridge device&#39;s refcnt by netdev_hold() and releases RTNL because the following br_ioctl_call() also re-acquires RTNL.</p> <p>In the race window, Thread B could acquire RTNL and try to remove the bridge device. Then, rtnl_unlock() by Thread B will release RTNL and wait for netdev_put() by Thread A.</p> <p>Thread A, however, must hold RTNL after the unlock in dev_ifsioc(), which may take long under RTNL pressure, resulting in the splat by Thread B.</p> <p>Thread A (SIOCBRDELIF) Thread B (SIOCBRDELBR) ---------------------- ---------------------- sock_ioctl sock_ioctl `- sock_do_ioctl `- br_ioctl_call `- dev_ioctl `- br_ioctl_stub |- rtnl_lock | |- dev_ifsioc &#39; &#39; |- dev = __dev_get_by_name(...) |- netdev_hold(dev, ...) . / |- rtnl_unlock ------. | | |- br_ioctl_call `---&gt; |- rtnl_lock Race | | `- br_ioctl_stub |- br_del_bridge Window | |…</p> <p><strong>Affected:</strong> Linux, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.</p> <p>SIOCBRDELIF is passed to dev_ioctl() first and later forwarded to br_ioctl_call(), which causes unnecessary RTNL dance and the splat below [0] under RTNL pressure.</p> <p>Let&#39;s say Thread A is trying to detach a device from a bridge and Thread B is trying to remove the bridge.</p> <p>In dev_ioctl(), Thread A bumps the bridge device&#39;s refcnt by netdev_hold() and releases RTNL because the following br_ioctl_call() also re-acquires RTNL.</p> <p>In the race window, Thread B could acquire RTNL and try to remove the bridge device. Then, rtnl_unlock() by Thread B will release RTNL and wait for netdev_put() by Thread A.</p> <p>Thread A, however, must hold RTNL after the unlock in dev_ifsioc(), which may take long under RTNL pressure, resulting in the splat by Thread B.</p> <p>Thread A (SIOCBRDELIF) Thread B (SIOCBRDELBR) ---------------------- ---------------------- sock_ioctl sock_ioctl `- sock_do_ioctl `- br_ioctl_call `- dev_ioctl `- br_ioctl_stub |- rtnl_lock | |- dev_ifsioc &#39; &#39; |- dev = __dev_get_by_name(...) |- netdev_hold(dev, ...) . / |- rtnl_unlock ------. | | |- br_ioctl_call `---&gt; |- rtnl_lock Race | | `- br_ioctl_stub |- br_del_bridge Window | |…</p> https://vulnerability.circl.lu/vuln/cve-2025-22111