{"id":"CVE-2025-38372","title":"RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix unsafe xarray access in implicit ODP handling\n\n__xa_store() and __xa_erase() were used without holding the proper lock,\nwhich led to a lockdep warning du…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 7cc8f681f6d4ae4478ae0f60485fc768f2b450da < 9d2ef890e49963b768d4fe5a33029aacd9f6b93f","Linux >= d3d930411ce390e532470194296658a960887773 < ebebffb47c78f63ba7e4fbde393e44af38b7625d","Linux >= d3d930411ce390e532470194296658a960887773 < 2c6b640ea08bff1a192bf87fa45246ff1e40767c","Linux a306dfff6b76aafa264ad33874a8992a8d5858b7","Linux edfb65dbb9ffd3102f3ff4dd21316158e56f1976","Linux >= 6.12.13 < 6.12.37","Linux >= 6.6.160 < 6.7","Linux >= 6.13.2 < 6.14","Linux 6.14"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:49:46.422571Z"},"published":"2025-07-25","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:37:02.465Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38372","references":[{"url":"https://git.kernel.org/stable/c/9d2ef890e49963b768d4fe5a33029aacd9f6b93f"},{"url":"https://git.kernel.org/stable/c/ebebffb47c78f63ba7e4fbde393e44af38b7625d"},{"url":"https://git.kernel.org/stable/c/2c6b640ea08bff1a192bf87fa45246ff1e40767c"}],"tags":["cve.org"],"epss":0.00222,"epssPercentile":0.12632,"ingestedAt":"2026-10-15T22:48:25.504Z","slug":"CVE-2025-38372","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix unsafe xarray access in implicit ODP handling\n\n__xa_store() and __xa_erase() were used without holding the proper lock,\nwhich led to a lockdep warning due to unsafe RCU usage.  This patch\nreplaces them with xa_store() and xa_erase(), which perform the necessary\nlocking internally.\n\n  =============================\n  WARNING: suspicious RCPU usage\n  6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Not tainted\n  -----------------------------\n  ./include/linux/xarray.h:1211 suspicious rcu_dereference_protected() usage!\n\n  other info that might help us debug this:\n\n  rcu_scheduler_active = 2, debug_locks = 1\n  3 locks held by kworker/u136:0/219:\n      at: process_one_work+0xbe4/0x15f0\n      process_one_work+0x75c/0x15f0\n      pagefault_mr+0x9a5/0x1390 [mlx5_ib]\n\n  stack backtrace:\n  CPU: 14 UID: 0 PID: 219 Comm: kworker/u136:0 Not tainted\n  6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\n  rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\n  Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib]\n  Call Trace:\n   dump_stack_lvl+0xa8/0xc0\n   lockdep_rcu_suspicious+0x1e6/0x260\n   xas_create+0xb8a/0xee0\n   xas_store+0x73/0x14c0\n   __xa_store+0x13c/0x220\n   ? xa_store_range+0x390/0x390\n   ? spin_bug+0x1d0/0x1d0\n   pagefault_mr+0xcb5/0x1390 [mlx5_ib]\n   ? _raw_spin_unlock+0x1f/0x30\n   mlx5_ib_eqe_pf_action+0x3be/0x2620 [mlx5_ib]\n   ? lockdep_hardirqs_on_prepare+0x400/0x400\n   ? mlx5_ib_invalidate_range+0xcb0/0xcb0 [mlx5_ib]\n   process_one_work+0x7db/0x15f0\n   ? pwq_dec_nr_in_flight+0xda0/0xda0\n   ? assign_work+0x168/0x240\n   worker_thread+0x57d/0xcd0\n   ? rescuer_thread+0xc40/0xc40\n   kthread+0x3b3/0x800\n   ? kthread_is_per_cpu+0xb0/0xb0\n   ? lock_downgrade+0x680/0x680\n   ? do_raw_spin_lock+0x12d/0x270\n   ? spin_bug+0x1d0/0x1d0\n   ? finish_task_switch.isra.0+0x284/0x9e0\n   ? lockdep_hardirqs_on_prepare+0x284/0x400\n   ? kthread_is_per_cpu+0xb0/0xb0\n   ret_from_fork+0x2d/0x70\n   ? kthread_is_per_cpu+0xb0/0xb0\n   ret_from_fork_asm+0x11/0x20\n\n## Affected\n\n- `Linux >= 7cc8f681f6d4ae4478ae0f60485fc768f2b450da < 9d2ef890e49963b768d4fe5a33029aacd9f6b93f`\n- `Linux >= d3d930411ce390e532470194296658a960887773 < ebebffb47c78f63ba7e4fbde393e44af38b7625d`\n- `Linux >= d3d930411ce390e532470194296658a960887773 < 2c6b640ea08bff1a192bf87fa45246ff1e40767c`\n- `Linux a306dfff6b76aafa264ad33874a8992a8d5858b7`\n- `Linux edfb65dbb9ffd3102f3ff4dd21316158e56f1976`\n- `Linux >= 6.12.13 < 6.12.37`\n- `Linux >= 6.6.160 < 6.7`\n- `Linux >= 6.13.2 < 6.14`\n- `Linux 6.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}