Bottlerocket: bottlerocket-kernel-6.12, kernel-6.12: security update to 6.12.29

medium Tenable Self-Hosted Container Security Plugin ID 428182

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: block: fix queue freeze vs limits lock
order in sysfs store methods queue_attr_store() always freezes a device queue before calling the attribute
store operation. For attributes that control queue limits, the store operation will also lock the queue
limits with a call to queue_limits_start_update(). However, some drivers (e.g. SCSI sd) may need to issue
commands to a device to obtain limit values from the hardware with the queue limits locked. This creates a
potential ABBA deadlock situation if a user attempts to modify a limit (thus freezing the device queue)
while the device driver starts a revalidation of the device queue limits. Avoid such deadlock by not
freezing the queue before calling the ->store_limit() method in struct queue_sysfs_entry and instead use
the queue_limits_commit_update_frozen helper to freeze the queue after taking the limits lock. This also
removes taking the sysfs lock for the store_limit method as it doesn't protect anything here, but creates
even more nesting. Hopefully it will go away from the actual sysfs methods entirely soon. (commit log
adapted from a similar patch from Damien Le Moal) (CVE-2025-21807)

Plugin Details

Severity: Medium

ID: 428182

Version: Revision 1.5

Type: Local

Family: Bottlerocket Local Security Checks

Published: 6/30/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-21807

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 2/27/2025

Reference Information

CVE: CVE-2025-21807

Detections

Analytics