Skip to main content

Linux Kernel CVE-2025-38372

MEDIUM
2025-07-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges required to trigger RDMA page fault; no data exfiltration or integrity impact; kernel panic yields high availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 08:56 vuln.today
CVE Published
Jul 25, 2025 - 13:15 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling

__xa_store() and __xa_erase() were used without holding the proper lock, which led to a lockdep warning due to unsafe RCU usage. This patch replaces them with xa_store() and xa_erase(), which perform the necessary locking internally.

========= WARNING: suspicious RCPU usage 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Not tainted ----------------------------- ./include/linux/xarray.h:1211 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1 3 locks held by kworker/u136:0/219: at: process_one_work+0xbe4/0x15f0 process_one_work+0x75c/0x15f0 pagefault_mr+0x9a5/0x1390 [mlx5_ib]

stack backtrace: CPU: 14 UID: 0 PID: 219 Comm: kworker/u136:0 Not tainted 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib] Call Trace: dump_stack_lvl+0xa8/0xc0 lockdep_rcu_suspicious+0x1e6/0x260 xas_create+0xb8a/0xee0 xas_store+0x73/0x14c0 __xa_store+0x13c/0x220 ? xa_store_range+0x390/0x390 ? spin_bug+0x1d0/0x1d0 pagefault_mr+0xcb5/0x1390 [mlx5_ib] ? _raw_spin_unlock+0x1f/0x30 mlx5_ib_eqe_pf_action+0x3be/0x2620 [mlx5_ib] ? lockdep_hardirqs_on_prepare+0x400/0x400 ? mlx5_ib_invalidate_range+0xcb0/0xcb0 [mlx5_ib] process_one_work+0x7db/0x15f0 ? pwq_dec_nr_in_flight+0xda0/0xda0 ? assign_work+0x168/0x240 worker_thread+0x57d/0xcd0 ? rescuer_thread+0xc40/0xc40 kthread+0x3b3/0x800 ? kthread_is_per_cpu+0xb0/0xb0 ? lock_downgrade+0x680/0x680 ? do_raw_spin_lock+0x12d/0x270 ? spin_bug+0x1d0/0x1d0 ? finish_task_switch.isra.0+0x284/0x9e0 ? lockdep_hardirqs_on_prepare+0x284/0x400 ? kthread_is_per_cpu+0xb0/0xb0 ret_from_fork+0x2d/0x70 ? kthread_is_per_cpu+0xb0/0xb0 ret_from_fork_asm+0x11/0x20

AnalysisAI

Unsafe XArray access in the Linux kernel's RDMA mlx5_ib driver causes a lockdep warning and potential kernel panic on systems using Mellanox/NVIDIA InfiniBand hardware with implicit On-Demand Paging (ODP). The non-locking xarray variants __xa_store() and __xa_erase() were called inside the mlx5 page fault handler pagefault_mr() without holding the required XArray spinlock, violating RCU protection invariants. A local low-privilege user on an affected system can trigger this condition via RDMA page fault events, causing kernel denial of service. No public exploit exists and EPSS is at the 4th percentile, indicating this is a kernel stability concern rather than an imminent exploitation target.

Technical ContextAI

The vulnerability resides in the RDMA (Remote Direct Memory Access) subsystem of the Linux kernel, specifically in the mlx5_ib driver for Mellanox/NVIDIA ConnectX InfiniBand adapters (CPE: cpe:2.3:o:linux:linux_kernel). Implicit ODP (On-Demand Paging) is an advanced RDMA feature allowing memory regions to be registered without pinning physical pages upfront; instead, page faults dynamically populate mappings via a dedicated kernel workqueue (mlx5_ib_page_fault). The XArray data structure used for tracking these memory mappings provides both locking (__xa_store/__xa_erase, caller must hold lock) and self-locking (xa_store/xa_erase) variants. The bug is that the unlocked variants were used in pagefault_mr() executed from the mlx5_ib_eqe_pf_action workqueue handler without acquiring the XArray lock first, triggering a suspicious rcu_dereference_protected() warning in xas_create(). While no CWE is formally assigned, this aligns with CWE-667 (Improper Locking) and CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization). The fix replaces the two offending calls with their self-locking counterparts.

RemediationAI

Apply the upstream kernel stable patches available at the following commit references: 2c6b640ea08bff1a192bf87fa45246ff1e40767c, 9d2ef890e49963b768d4fe5a33029aacd9f6b93f, and ebebffb47c78f63ba7e4fbde393e44af38b7625d (all at https://git.kernel.org/stable/c/). These patches replace __xa_store() and __xa_erase() with their self-locking counterparts in the pagefault_mr() code path. Exact patched named kernel release versions are not independently confirmed from available data - these are upstream stable tree commits not yet associated with a tagged point release per available intelligence. As a compensating control for environments that cannot patch immediately, unloading the mlx5_ib kernel module (modprobe -r mlx5_ib) eliminates the vulnerable code path entirely, though this disables all mlx5 InfiniBand RDMA functionality on the system. Systems without mlx5 RDMA hardware require no action.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Linux Enterprise High Availability Extension 16.0 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server 16.1 Fixed

Share

CVE-2025-38372 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy