CVE-2025-38392 (GCVE-0-2025-38392)
Vulnerability from cvelistv5
Published
2025-07-25 12:53
Modified
2025-07-28 04:20
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: idpf: convert control queue mutex to a spinlock With VIRTCHNL2_CAP_MACFILTER enabled, the following warning is generated on module load: [ 324.701677] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:578 [ 324.701684] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1582, name: NetworkManager [ 324.701689] preempt_count: 201, expected: 0 [ 324.701693] RCU nest depth: 0, expected: 0 [ 324.701697] 2 locks held by NetworkManager/1582: [ 324.701702] #0: ffffffff9f7be770 (rtnl_mutex){....}-{3:3}, at: rtnl_newlink+0x791/0x21e0 [ 324.701730] #1: ff1100216c380368 (_xmit_ETHER){....}-{2:2}, at: __dev_open+0x3f0/0x870 [ 324.701749] Preemption disabled at: [ 324.701752] [<ffffffff9cd23b9d>] __dev_open+0x3dd/0x870 [ 324.701765] CPU: 30 UID: 0 PID: 1582 Comm: NetworkManager Not tainted 6.15.0-rc5+ #2 PREEMPT(voluntary) [ 324.701771] Hardware name: Intel Corporation M50FCP2SBSTD/M50FCP2SBSTD, BIOS SE5C741.86B.01.01.0001.2211140926 11/14/2022 [ 324.701774] Call Trace: [ 324.701777] <TASK> [ 324.701779] dump_stack_lvl+0x5d/0x80 [ 324.701788] ? __dev_open+0x3dd/0x870 [ 324.701793] __might_resched.cold+0x1ef/0x23d <..> [ 324.701818] __mutex_lock+0x113/0x1b80 <..> [ 324.701917] idpf_ctlq_clean_sq+0xad/0x4b0 [idpf] [ 324.701935] ? kasan_save_track+0x14/0x30 [ 324.701941] idpf_mb_clean+0x143/0x380 [idpf] <..> [ 324.701991] idpf_send_mb_msg+0x111/0x720 [idpf] [ 324.702009] idpf_vc_xn_exec+0x4cc/0x990 [idpf] [ 324.702021] ? rcu_is_watching+0x12/0xc0 [ 324.702035] idpf_add_del_mac_filters+0x3ed/0xb50 [idpf] <..> [ 324.702122] __hw_addr_sync_dev+0x1cf/0x300 [ 324.702126] ? find_held_lock+0x32/0x90 [ 324.702134] idpf_set_rx_mode+0x317/0x390 [idpf] [ 324.702152] __dev_open+0x3f8/0x870 [ 324.702159] ? __pfx___dev_open+0x10/0x10 [ 324.702174] __dev_change_flags+0x443/0x650 <..> [ 324.702208] netif_change_flags+0x80/0x160 [ 324.702218] do_setlink.isra.0+0x16a0/0x3960 <..> [ 324.702349] rtnl_newlink+0x12fd/0x21e0 The sequence is as follows: rtnl_newlink()-> __dev_change_flags()-> __dev_open()-> dev_set_rx_mode() - > # disables BH and grabs "dev->addr_list_lock" idpf_set_rx_mode() -> # proceed only if VIRTCHNL2_CAP_MACFILTER is ON __dev_uc_sync() -> idpf_add_mac_filter -> idpf_add_del_mac_filters -> idpf_send_mb_msg() -> idpf_mb_clean() -> idpf_ctlq_clean_sq() # mutex_lock(cq_lock) Fix by converting cq_lock to a spinlock. All operations under the new lock are safe except freeing the DMA memory, which may use vunmap(). Fix by requesting a contiguous physical memory for the DMA mapping.
References
Impacted products
Vendor Product Version
Linux Linux Version: a251eee62133774cf35ff829041377e721ef9c8c
Version: a251eee62133774cf35ff829041377e721ef9c8c
Version: a251eee62133774cf35ff829041377e721ef9c8c
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/idpf/idpf_controlq.c",
            "drivers/net/ethernet/intel/idpf/idpf_controlq_api.h",
            "drivers/net/ethernet/intel/idpf/idpf_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9a36715cd6bc6a6f16230e19a7f947bab34b3fe5",
              "status": "affected",
              "version": "a251eee62133774cf35ff829041377e721ef9c8c",
              "versionType": "git"
            },
            {
              "lessThan": "dc6c3c2c9dfdaa3a3357f59a80a2904677a71a9a",
              "status": "affected",
              "version": "a251eee62133774cf35ff829041377e721ef9c8c",
              "versionType": "git"
            },
            {
              "lessThan": "b2beb5bb2cd90d7939e470ed4da468683f41baa3",
              "status": "affected",
              "version": "a251eee62133774cf35ff829041377e721ef9c8c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/idpf/idpf_controlq.c",
            "drivers/net/ethernet/intel/idpf/idpf_controlq_api.h",
            "drivers/net/ethernet/intel/idpf/idpf_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: convert control queue mutex to a spinlock\n\nWith VIRTCHNL2_CAP_MACFILTER enabled, the following warning is generated\non module load:\n\n[  324.701677] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:578\n[  324.701684] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1582, name: NetworkManager\n[  324.701689] preempt_count: 201, expected: 0\n[  324.701693] RCU nest depth: 0, expected: 0\n[  324.701697] 2 locks held by NetworkManager/1582:\n[  324.701702]  #0: ffffffff9f7be770 (rtnl_mutex){....}-{3:3}, at: rtnl_newlink+0x791/0x21e0\n[  324.701730]  #1: ff1100216c380368 (_xmit_ETHER){....}-{2:2}, at: __dev_open+0x3f0/0x870\n[  324.701749] Preemption disabled at:\n[  324.701752] [\u003cffffffff9cd23b9d\u003e] __dev_open+0x3dd/0x870\n[  324.701765] CPU: 30 UID: 0 PID: 1582 Comm: NetworkManager Not tainted 6.15.0-rc5+ #2 PREEMPT(voluntary)\n[  324.701771] Hardware name: Intel Corporation M50FCP2SBSTD/M50FCP2SBSTD, BIOS SE5C741.86B.01.01.0001.2211140926 11/14/2022\n[  324.701774] Call Trace:\n[  324.701777]  \u003cTASK\u003e\n[  324.701779]  dump_stack_lvl+0x5d/0x80\n[  324.701788]  ? __dev_open+0x3dd/0x870\n[  324.701793]  __might_resched.cold+0x1ef/0x23d\n\u003c..\u003e\n[  324.701818]  __mutex_lock+0x113/0x1b80\n\u003c..\u003e\n[  324.701917]  idpf_ctlq_clean_sq+0xad/0x4b0 [idpf]\n[  324.701935]  ? kasan_save_track+0x14/0x30\n[  324.701941]  idpf_mb_clean+0x143/0x380 [idpf]\n\u003c..\u003e\n[  324.701991]  idpf_send_mb_msg+0x111/0x720 [idpf]\n[  324.702009]  idpf_vc_xn_exec+0x4cc/0x990 [idpf]\n[  324.702021]  ? rcu_is_watching+0x12/0xc0\n[  324.702035]  idpf_add_del_mac_filters+0x3ed/0xb50 [idpf]\n\u003c..\u003e\n[  324.702122]  __hw_addr_sync_dev+0x1cf/0x300\n[  324.702126]  ? find_held_lock+0x32/0x90\n[  324.702134]  idpf_set_rx_mode+0x317/0x390 [idpf]\n[  324.702152]  __dev_open+0x3f8/0x870\n[  324.702159]  ? __pfx___dev_open+0x10/0x10\n[  324.702174]  __dev_change_flags+0x443/0x650\n\u003c..\u003e\n[  324.702208]  netif_change_flags+0x80/0x160\n[  324.702218]  do_setlink.isra.0+0x16a0/0x3960\n\u003c..\u003e\n[  324.702349]  rtnl_newlink+0x12fd/0x21e0\n\nThe sequence is as follows:\n\trtnl_newlink()-\u003e\n\t__dev_change_flags()-\u003e\n\t__dev_open()-\u003e\n\tdev_set_rx_mode() - \u003e  # disables BH and grabs \"dev-\u003eaddr_list_lock\"\n\tidpf_set_rx_mode() -\u003e  # proceed only if VIRTCHNL2_CAP_MACFILTER is ON\n\t__dev_uc_sync() -\u003e\n\tidpf_add_mac_filter -\u003e\n\tidpf_add_del_mac_filters -\u003e\n\tidpf_send_mb_msg() -\u003e\n\tidpf_mb_clean() -\u003e\n\tidpf_ctlq_clean_sq()   # mutex_lock(cq_lock)\n\nFix by converting cq_lock to a spinlock. All operations under the new\nlock are safe except freeing the DMA memory, which may use vunmap(). Fix\nby requesting a contiguous physical memory for the DMA mapping."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-28T04:20:56.271Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9a36715cd6bc6a6f16230e19a7f947bab34b3fe5"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc6c3c2c9dfdaa3a3357f59a80a2904677a71a9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2beb5bb2cd90d7939e470ed4da468683f41baa3"
        }
      ],
      "title": "idpf: convert control queue mutex to a spinlock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38392",
    "datePublished": "2025-07-25T12:53:37.175Z",
    "dateReserved": "2025-04-16T04:51:24.011Z",
    "dateUpdated": "2025-07-28T04:20:56.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38392\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T13:15:28.617\",\"lastModified\":\"2025-07-25T15:29:19.837\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nidpf: convert control queue mutex to a spinlock\\n\\nWith VIRTCHNL2_CAP_MACFILTER enabled, the following warning is generated\\non module load:\\n\\n[  324.701677] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:578\\n[  324.701684] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1582, name: NetworkManager\\n[  324.701689] preempt_count: 201, expected: 0\\n[  324.701693] RCU nest depth: 0, expected: 0\\n[  324.701697] 2 locks held by NetworkManager/1582:\\n[  324.701702]  #0: ffffffff9f7be770 (rtnl_mutex){....}-{3:3}, at: rtnl_newlink+0x791/0x21e0\\n[  324.701730]  #1: ff1100216c380368 (_xmit_ETHER){....}-{2:2}, at: __dev_open+0x3f0/0x870\\n[  324.701749] Preemption disabled at:\\n[  324.701752] [\u003cffffffff9cd23b9d\u003e] __dev_open+0x3dd/0x870\\n[  324.701765] CPU: 30 UID: 0 PID: 1582 Comm: NetworkManager Not tainted 6.15.0-rc5+ #2 PREEMPT(voluntary)\\n[  324.701771] Hardware name: Intel Corporation M50FCP2SBSTD/M50FCP2SBSTD, BIOS SE5C741.86B.01.01.0001.2211140926 11/14/2022\\n[  324.701774] Call Trace:\\n[  324.701777]  \u003cTASK\u003e\\n[  324.701779]  dump_stack_lvl+0x5d/0x80\\n[  324.701788]  ? __dev_open+0x3dd/0x870\\n[  324.701793]  __might_resched.cold+0x1ef/0x23d\\n\u003c..\u003e\\n[  324.701818]  __mutex_lock+0x113/0x1b80\\n\u003c..\u003e\\n[  324.701917]  idpf_ctlq_clean_sq+0xad/0x4b0 [idpf]\\n[  324.701935]  ? kasan_save_track+0x14/0x30\\n[  324.701941]  idpf_mb_clean+0x143/0x380 [idpf]\\n\u003c..\u003e\\n[  324.701991]  idpf_send_mb_msg+0x111/0x720 [idpf]\\n[  324.702009]  idpf_vc_xn_exec+0x4cc/0x990 [idpf]\\n[  324.702021]  ? rcu_is_watching+0x12/0xc0\\n[  324.702035]  idpf_add_del_mac_filters+0x3ed/0xb50 [idpf]\\n\u003c..\u003e\\n[  324.702122]  __hw_addr_sync_dev+0x1cf/0x300\\n[  324.702126]  ? find_held_lock+0x32/0x90\\n[  324.702134]  idpf_set_rx_mode+0x317/0x390 [idpf]\\n[  324.702152]  __dev_open+0x3f8/0x870\\n[  324.702159]  ? __pfx___dev_open+0x10/0x10\\n[  324.702174]  __dev_change_flags+0x443/0x650\\n\u003c..\u003e\\n[  324.702208]  netif_change_flags+0x80/0x160\\n[  324.702218]  do_setlink.isra.0+0x16a0/0x3960\\n\u003c..\u003e\\n[  324.702349]  rtnl_newlink+0x12fd/0x21e0\\n\\nThe sequence is as follows:\\n\\trtnl_newlink()-\u003e\\n\\t__dev_change_flags()-\u003e\\n\\t__dev_open()-\u003e\\n\\tdev_set_rx_mode() - \u003e  # disables BH and grabs \\\"dev-\u003eaddr_list_lock\\\"\\n\\tidpf_set_rx_mode() -\u003e  # proceed only if VIRTCHNL2_CAP_MACFILTER is ON\\n\\t__dev_uc_sync() -\u003e\\n\\tidpf_add_mac_filter -\u003e\\n\\tidpf_add_del_mac_filters -\u003e\\n\\tidpf_send_mb_msg() -\u003e\\n\\tidpf_mb_clean() -\u003e\\n\\tidpf_ctlq_clean_sq()   # mutex_lock(cq_lock)\\n\\nFix by converting cq_lock to a spinlock. All operations under the new\\nlock are safe except freeing the DMA memory, which may use vunmap(). Fix\\nby requesting a contiguous physical memory for the DMA mapping.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/9a36715cd6bc6a6f16230e19a7f947bab34b3fe5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b2beb5bb2cd90d7939e470ed4da468683f41baa3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dc6c3c2c9dfdaa3a3357f59a80a2904677a71a9a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.