{"id":"CVE-2025-38440","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix race between DIM disable and net_dim()\n\nThere's a race between disabling DIM and NAPI callbacks using the dim\npointer on the RQ or SQ.\n\nIf NAPI checks th…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix race between DIM disable and net_dim()\n\nThere's a race between disabling DIM and NAPI callbacks using the dim\npointer on the RQ or SQ.\n\nIf NAPI checks th…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-362","CWE-367"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 6.10, < 6.12.39","linux_kernel >= 6.13, < 6.15.7","linux_kernel = 6.16"],"patched":["linux_kernel 6.15.7"],"published":"2025-07-25","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:18:41.243","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-38440","references":[{"url":"https://git.kernel.org/stable/c/2bc6fb90486e42dd80e660ef7a40c02b2516c6d6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7581afc051542e11ccf3ade68acd01b7fb1a3cde","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb41a264a3a576dc040ee37c3d9d6b7e2d9be968","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38440.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-38440"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2383492"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-38440"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38440"},{"url":"https://lore.kernel.org/linux-cve-announce/2025072501-CVE-2025-38440-cb71@gregkh/T"}],"tags":["nvd","csaf","vex","red-hat","cve.org","score-dispute"],"epss":0.00143,"epssPercentile":0.03612,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:50:26.078086Z"},"scores":{"nvd":7.8,"vendor":4.7,"cna":7.8},"ingestedAt":"2026-10-15T22:48:25.507Z","slug":"CVE-2025-38440","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix race between DIM disable and net_dim()\n\nThere's a race between disabling DIM and NAPI callbacks using the dim\npointer on the RQ or SQ.\n\nIf NAPI checks the DIM state bit and sees it still set, it assumes\n`rq->dim` or `sq->dim` is valid. But if DIM gets disabled right after\nthat check, the pointer might already be set to NULL, leading to a NULL\npointer dereference in net_dim().\n\nFix this by calling `synchronize_net()` before freeing the DIM context.\nThis ensures all in-progress NAPI callbacks are finished before the\npointer is cleared.\n\nKernel log:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n...\nRIP: 0010:net_dim+0x23/0x190\n...\nCall Trace:\n <TASK>\n ? __die+0x20/0x60\n ? page_fault_oops+0x150/0x3e0\n ? common_interrupt+0xf/0xa0\n ? sysvec_call_function_single+0xb/0x90\n ? exc_page_fault+0x74/0x130\n ? asm_exc_page_fault+0x22/0x30\n ? net_dim+0x23/0x190\n ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core]\n ? sysvec_apic_timer_interrupt+0xb/0x90\n mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core]\n mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core]\n ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core]\n busy_poll_stop+0xa2/0x200\n ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core]\n ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core]\n __napi_busy_loop+0x345/0x3b0\n ? sysvec_call_function_single+0xb/0x90\n ? asm_sysvec_call_function_single+0x16/0x20\n ? sysvec_apic_timer_interrupt+0xb/0x90\n ? pcpu_free_area+0x1e4/0x2e0\n napi_busy_loop+0x11/0x20\n xsk_recvmsg+0x10c/0x130\n sock_recvmsg+0x44/0x70\n __sys_recvfrom+0xbc/0x130\n ? __schedule+0x398/0x890\n __x64_sys_recvfrom+0x20/0x30\n do_syscall_64+0x4c/0x100\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n...\n---[ end trace 0000000000000000 ]---\n...\n---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---\n\n## Affected\n\n- `linux_kernel >= 6.10, < 6.12.39`\n- `linux_kernel >= 6.13, < 6.15.7`\n- `linux_kernel = 6.16`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.15.7`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38440.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":230051,"id":"CVE-2025-38440","ts":1793124776896,"field":"cvss","old":"4.7","new":"7.8"},{"seq":230050,"id":"CVE-2025-38440","ts":1793124776896,"field":"severity","old":"medium","new":"high"},{"seq":223729,"id":"CVE-2025-38440","ts":1792238378327,"field":"cvss","old":"7.8","new":"4.7"},{"seq":223728,"id":"CVE-2025-38440","ts":1792238378327,"field":"severity","old":"high","new":"medium"}]}