CVE-2025-38326: aoe: clean device rq_list in aoedev_downdev()
In the Linux kernel, the following vulnerability has been resolved:
aoe: clean device rqlist in aoedevdowndev()
An aoe device's rqlist contains accepted block requests that are waiting to be transmitted to the aoe target. This queue was added as part of the conversion to blkmq. However, the queue was not cleaned out when an aoe device is downed which caused blkmqfreezequeue() to sleep indefinitely waiting for those requests to complete, causing a hang. This fix cleans out the queue before calling blkmqfreezequeue().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38326?
The severity of CVE-2025-38326 has been classified based on its potential impact on the Linux kernel's functionality and security.
What systems are affected by CVE-2025-38326?
CVE-2025-38326 affects devices running the Linux kernel that utilize aoe devices for block requests.
How do I fix CVE-2025-38326?
To remediate CVE-2025-38326, update your Linux kernel to the latest stable version where the vulnerability has been resolved.
What does CVE-2025-38326 affect in the Linux kernel?
CVE-2025-38326 affects the rq_list handling within the aoe device management in the Linux kernel.
What is an aoe device in the context of CVE-2025-38326?
An aoe device refers to ATA over Ethernet devices that manage block requests for data transmission in a networked environment.