CVE-2025-21862: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-21862 affects the Linux kernel's drop_monitor module, discovered in March 2025. The vulnerability stems from an incorrect initialization order in the drop_monitor module, where a spinlock is used before being properly initialized. This issue affects multiple versions of the Linux kernel, including versions from 2.6.30 to 6.1.130, 6.2 to 6.6.80, 6.7 to 6.12.17, and 6.13 to 6.13.5 (NVD).

The vulnerability occurs when drop_monitor is built as a kernel module. During module loading, there is a race condition where a netlink NET_DM_CMD_START message can be sent before proper initialization. This triggers the net_dm_monitor_start() function, which attempts to use an uninitialized spinlock, resulting in a 'spinlock bad magic' error. The issue was identified using the Syzkaller kernel fuzzer and has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to system instability or potential denial of service when the drop_monitor module is loaded. The CVSS scoring indicates that while the vulnerability requires local access and cannot directly compromise system confidentiality or integrity, it can have a high impact on system availability (NVD).

The vulnerability requires local access and can be triggered during the module loading process. It was discovered through automated testing using the Syzkaller kernel fuzzer by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) (Kernel Patch).

The issue has been fixed by reordering the initialization sequence in the drop_monitor module. The patch places resource initialization above the registration of the generic netlink family, ensuring that the spinlock is properly initialized before it can be used. The fix has been merged into the mainline kernel and is being backported to stable kernel versions (Kernel Patch).