---
id: CVE-2025-38440
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/mlx5e: Fix race between DIM disable and net_dim()

  There's a race between disabling DIM and NAPI callbacks using the dim
  pointer on the RQ or SQ.

  If NAPI checks th…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/mlx5e: Fix race between DIM disable and net_dim()

  There's a race between disabling DIM and NAPI callbacks using the dim
  pointer on the RQ or SQ.

  If NAPI checks th…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-362
  - CWE-367
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.10, < 6.12.39'
  - 'linux_kernel >= 6.13, < 6.15.7'
  - linux_kernel = 6.16
patched:
  - linux_kernel 6.15.7
published: '2025-07-25'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:41.243'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38440'
references:
  - url: 'https://git.kernel.org/stable/c/2bc6fb90486e42dd80e660ef7a40c02b2516c6d6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7581afc051542e11ccf3ade68acd01b7fb1a3cde'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/eb41a264a3a576dc040ee37c3d9d6b7e2d9be968'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38440.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-38440'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2383492'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-38440'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38440'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2025072501-CVE-2025-38440-cb71@gregkh/T
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00143
epssPercentile: 0.03612
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:50:26.078086Z'
scores:
  nvd: 7.8
  vendor: 4.7
  cna: 7.8
ingestedAt: '2026-10-15T22:48:25.507Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix race between DIM disable and net_dim()

There's a race between disabling DIM and NAPI callbacks using the dim
pointer on the RQ or SQ.

If NAPI checks the DIM state bit and sees it still set, it assumes
`rq->dim` or `sq->dim` is valid. But if DIM gets disabled right after
that check, the pointer might already be set to NULL, leading to a NULL
pointer dereference in net_dim().

Fix this by calling `synchronize_net()` before freeing the DIM context.
This ensures all in-progress NAPI callbacks are finished before the
pointer is cleared.

Kernel log:

BUG: kernel NULL pointer dereference, address: 0000000000000000
...
RIP: 0010:net_dim+0x23/0x190
...
Call Trace:
 <TASK>
 ? __die+0x20/0x60
 ? page_fault_oops+0x150/0x3e0
 ? common_interrupt+0xf/0xa0
 ? sysvec_call_function_single+0xb/0x90
 ? exc_page_fault+0x74/0x130
 ? asm_exc_page_fault+0x22/0x30
 ? net_dim+0x23/0x190
 ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core]
 ? sysvec_apic_timer_interrupt+0xb/0x90
 mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core]
 mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core]
 ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core]
 busy_poll_stop+0xa2/0x200
 ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core]
 ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core]
 __napi_busy_loop+0x345/0x3b0
 ? sysvec_call_function_single+0xb/0x90
 ? asm_sysvec_call_function_single+0x16/0x20
 ? sysvec_apic_timer_interrupt+0xb/0x90
 ? pcpu_free_area+0x1e4/0x2e0
 napi_busy_loop+0x11/0x20
 xsk_recvmsg+0x10c/0x130
 sock_recvmsg+0x44/0x70
 __sys_recvfrom+0xbc/0x130
 ? __schedule+0x398/0x890
 __x64_sys_recvfrom+0x20/0x30
 do_syscall_64+0x4c/0x100
 entry_SYSCALL_64_after_hwframe+0x4b/0x53
...
---[ end trace 0000000000000000 ]---
...
---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

## Affected

- `linux_kernel >= 6.10, < 6.12.39`
- `linux_kernel >= 6.13, < 6.15.7`
- `linux_kernel = 6.16`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.15.7`

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38440.json)