In recent times, a critical vulnerability has been identified and resolved in the Linux kernel. This vulnerability (CVE-2025-21690) affects the SCSI subsystem, specifically the "storvsc" driver. The issue occurs when a persistent error in the hypervisor causes the SCSI warning messages to flood the kernel log and max out CPU usage, effectively generating a denial of service (DoS) for the virtual machine (VM).

In this post, we will go through the details of the issue, its impact, and the resolution that has been made available.

CVE Details

CVE-ID: CVE-2025-21690
Affected Component: SCSI, storvsc driver
Impact: Denial of Service (DoS)
Severity: High

Issue Description

When the "storvsc" driver encounters a persistent error initiated by the hypervisor, the SCSI warning messages related to failed I/O operations can flood the kernel log. As a consequence, this can lead to high CPU usage, ultimately causing a Denial of Service (DoS) for the VM.

Resolution

The solution to this issue is to implement rate-limiting on the SCSI warning messages, ensuring that the warning messages don't flood the kernel log and cause a DoS issues for the virtual machine.

The following code snippet demonstrates how rate-limiting can be implemented to resolve this issue

#include <linux/ratelimit.h>

/* Define the ratelimit state and interval */
static DEFINE_RATELIMIT_STATE(_rs, DEFAULT_RATELIMIT_INTERVAL,
                                  DEFAULT_RATELIMIT_BURST);

/* Check if the warning can be logged */
if (__ratelimit(&_rs))
  printk(KERN_WARNING "scsi: storvsc: Failed I/O warning\n");

This code utilizes the ratelimit state, default ratelimit interval, and default ratelimit burst macros from. It checks if the warning can be logged using the __ratelimit() function, and if it can, the warning message is printed.

To delve deeper into this issue, you can refer to the following resources

1. Linux kernel mailing list discussion on the issue
2. Linux kernel patch for the issue
3. CVE-2025-21690 on the National Vulnerability Database (NVD)

Exploit Details

As of now, there haven't been any reported exploits of this vulnerability in the wild. Nonetheless, it is highly recommended that users and administrators apply the necessary patches and updates to prevent any potential exploitation of this vulnerability.

Conclusion

In conclusion, we hope this post helps in understanding the Linux kernel vulnerability CVE-2025-21690, its impact on the system, and the solution implemented to resolve it. The vulnerability highlights the importance of rate-limiting and resource management to ensure system stability, especially in VM environments. It is crucial that all users and administrators stay vigilant and up-to-date on the latest security patches and updates to keep their systems secure.

Timeline

Published on: 02/10/2025 16:15:38 UTC
Last modified on: 03/24/2025 15:38:57 UTC