CVE-2025-38440: net/mlx5e: Fix race between DIM disable and net_dim()
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix race between DIM disable and netdim()
There's a race between disabling DIM and NAPI callbacks using the dim pointer on the RQ or SQ.
If NAPI checks the DIM state bit and sees it still set, it assumes rq->dim or sq->dim is valid. But if DIM gets disabled right after that check, the pointer might already be set to NULL, leading to a NULL pointer dereference in netdim().
Fix this by calling synchronizenet() before freeing the DIM context. This ensures all in-progress NAPI callbacks are finished before the pointer is cleared.
Kernel log:
BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:netdim+0x23/0x190 ... Call Trace: <TASK> ? die+0x20/0x60 ? pagefaultoops+0x150/0x3e0 ? commoninterrupt+0xf/0xa0 ? sysveccallfunctionsingle+0xb/0x90 ? excpagefault+0x74/0x130 ? asmexcpagefault+0x22/0x30 ? netdim+0x23/0x190 ? mlx5epollicocq+0x41/0x6f0 [mlx5core] ? sysvecapictimerinterrupt+0xb/0x90 mlx5ehandlerxdim+0x92/0xd0 [mlx5core] mlx5enapipoll+0x2cd/0xac0 [mlx5core] ? mlx5epollicocq+0xe5/0x6f0 [mlx5core] busypollstop+0xa2/0x200 ? mlx5enapipoll+0x1d9/0xac0 [mlx5core] ? mlx5etriggerirq+0x130/0x130 [mlx5core] napibusyloop+0x345/0x3b0 ? sysveccallfunctionsingle+0xb/0x90 ? asmsysveccallfunctionsingle+0x16/0x20 ? sysvecapictimerinterrupt+0xb/0x90 ? pcpufreearea+0x1e4/0x2e0 napibusyloop+0x11/0x20 xskrecvmsg+0x10c/0x130 sockrecvmsg+0x44/0x70 sysrecvfrom+0xbc/0x130 ? schedule+0x398/0x890 x64sysrecvfrom+0x20/0x30 dosyscall64+0x4c/0x100 entrySYSCALL64afterhwframe+0x4b/0x53 ... ---[ end trace 0000000000000000 ]--- ... ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Call synchronize_net() before freeing the DIM context, ensuring all in-progress NAPI callbacks finish before the DIM pointer is cleared.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38440?
The severity of CVE-2025-38440 is currently classified as medium due to the potential for race condition issues in the Linux kernel.
How do I fix CVE-2025-38440?
To fix CVE-2025-38440, ensure you update the Linux kernel to the latest stable version where this vulnerability has been addressed.
What are the potential impacts of CVE-2025-38440?
CVE-2025-38440 could lead to race conditions that may disrupt the network packet processing functionality.
Is CVE-2025-38440 present in all versions of the Linux kernel?
CVE-2025-38440 affects specific versions of the Linux kernel, so it’s important to check your current version against the vulnerability disclosures.
Who is affected by CVE-2025-38440?
Any systems running the affected versions of the Linux kernel that utilize the mlx5e driver may be at risk due to CVE-2025-38440.