CVE-2025-21745

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: Fix class @block_class's subsystem refcount leakage

blkcg_fill_root_iostats() iterates over @block_class's devices by class_dev_iter_(init|next)(), but does not end iterating with class_dev_iter_exit(), so causes the class's subsystem refcount leakage.

Fix by ending the iterating with class_dev_iter_exit().

This vulnerability is rated as Moderate rather than Important because exploitation is restricted to local authenticated users querying root cgroup block I/O statistics, resulting in a gradual resource reference leak that can ultimately trigger a denial of service. On default Red Hat Enterprise Linux deployments utilizing cgroup v2, unprivileged local users or processes repeatedly inspecting root block performance metrics may cause the block subsystem reference counter to increment indefinitely without being properly released. Because this defect requires authenticated local system access and cannot compromise confidentiality or data integrity, its overall operational risk remains contained.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.