CVE-2025-38372: RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling
xastore() and xaerase() were used without holding the proper lock, which led to a lockdep warning due to unsafe RCU usage. This patch replaces them with xastore() and xaerase(), which perform the necessary locking internally.
============================= WARNING: suspicious RCPU usage 6.14.0-rc7forupstreamdebug202503181501 #1 Not tainted ----------------------------- ./include/linux/xarray.h:1211 suspicious rcudereferenceprotected() usage!
other info that might help us debug this:
rcuscheduleractive = 2, debuglocks = 1 3 locks held by kworker/u136:0/219: at: processonework+0xbe4/0x15f0 processonework+0x75c/0x15f0 pagefaultmr+0x9a5/0x1390 [mlx5ib]
stack backtrace: CPU: 14 UID: 0 PID: 219 Comm: kworker/u136:0 Not tainted 6.14.0-rc7forupstreamdebug202503181501 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5ibpagefault mlx5ibeqepfaction [mlx5ib] Call Trace: dumpstacklvl+0xa8/0xc0 lockdeprcususpicious+0x1e6/0x260 xascreate+0xb8a/0xee0 xasstore+0x73/0x14c0 xastore+0x13c/0x220 ? xastorerange+0x390/0x390 ? spinbug+0x1d0/0x1d0 pagefaultmr+0xcb5/0x1390 [mlx5ib] ? rawspinunlock+0x1f/0x30 mlx5ibeqepfaction+0x3be/0x2620 [mlx5ib] ? lockdephardirqsonprepare+0x400/0x400 ? mlx5ibinvalidaterange+0xcb0/0xcb0 [mlx5ib] processonework+0x7db/0x15f0 ? pwqdecnrinflight+0xda0/0xda0 ? assignwork+0x168/0x240 workerthread+0x57d/0xcd0 ? rescuerthread+0xc40/0xc40 kthread+0x3b3/0x800 ? kthreadispercpu+0xb0/0xb0 ? lockdowngrade+0x680/0x680 ? dorawspinlock+0x12d/0x270 ? spinbug+0x1d0/0x1d0 ? finishtaskswitch.isra.0+0x284/0x9e0 ? lockdephardirqsonprepare+0x284/0x400 ? kthreadispercpu+0xb0/0xb0 retfromfork+0x2d/0x70 ? kthreadispercpu+0xb0/0xb0 retfromforkasm+0x11/0x20
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.37-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.37 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.15.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-aws-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1015.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-nvidia-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-gcp-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1018.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oem-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-oracle-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1015.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-34.34.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1014.14~24.04.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38372?
CVE-2025-38372 is considered a moderate severity vulnerability due to unsafe RCU usage in the Linux kernel.
How do I fix CVE-2025-38372?
To fix CVE-2025-38372, update your Linux kernel to the latest version where this vulnerability has been addressed.
Which versions of the Linux kernel are affected by CVE-2025-38372?
CVE-2025-38372 affects specific versions of the Linux kernel prior to the patch that resolves the unsafe xarray access.
What are the potential impacts of CVE-2025-38372?
The potential impacts of CVE-2025-38372 include denial of service and unintended behavior in RDMA operations.
Is CVE-2025-38372 related to hardware vulnerabilities?
No, CVE-2025-38372 is a software vulnerability specifically within the Linux kernel related to RDMA processing.