CVE-2025-21728: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: bpf: Send signals asynchronously if !preemptible BPF programs can execute in all kinds of contexts and when a program running in a non-preemptible context uses the bpf_send_signal() kfunc, it will cause issues because this kfunc can sleep. Change `irqs_disabled()` to `!preemptible()`.

Affected products

• Linux Linux Kernel: from 5.4.33, before 5.4.291 (fixed in 5.4.291); from 5.5.18, before 5.6 (fixed in 5.6); from 5.6.1, before 5.10.235 (fixed in 5.10.235); from 5.11, before 5.15.179 (fixed in 5.15.179); from 5.16, before 6.1.129 (fixed in 6.1.129); from 6.2, before 6.6.76 (fixed in 6.6.76); …

Published 2025-02-27. Last modified 2026-06-17.