CVE-2025-38440 (GCVE-0-2025-38440)
Vulnerability from cvelistv5
Published
2025-07-25 15:27
Modified
2025-07-28 04:22
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix race between DIM disable and net_dim() There's a race between disabling DIM and NAPI callbacks using the dim pointer on the RQ or SQ. If NAPI checks the DIM state bit and sees it still set, it assumes `rq->dim` or `sq->dim` is valid. But if DIM gets disabled right after that check, the pointer might already be set to NULL, leading to a NULL pointer dereference in net_dim(). Fix this by calling `synchronize_net()` before freeing the DIM context. This ensures all in-progress NAPI callbacks are finished before the pointer is cleared. Kernel log: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:net_dim+0x23/0x190 ... Call Trace: <TASK> ? __die+0x20/0x60 ? page_fault_oops+0x150/0x3e0 ? common_interrupt+0xf/0xa0 ? sysvec_call_function_single+0xb/0x90 ? exc_page_fault+0x74/0x130 ? asm_exc_page_fault+0x22/0x30 ? net_dim+0x23/0x190 ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core] ? sysvec_apic_timer_interrupt+0xb/0x90 mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core] mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core] ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core] busy_poll_stop+0xa2/0x200 ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core] ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core] __napi_busy_loop+0x345/0x3b0 ? sysvec_call_function_single+0xb/0x90 ? asm_sysvec_call_function_single+0x16/0x20 ? sysvec_apic_timer_interrupt+0xb/0x90 ? pcpu_free_area+0x1e4/0x2e0 napi_busy_loop+0x11/0x20 xsk_recvmsg+0x10c/0x130 sock_recvmsg+0x44/0x70 __sys_recvfrom+0xbc/0x130 ? __schedule+0x398/0x890 __x64_sys_recvfrom+0x20/0x30 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ... ---[ end trace 0000000000000000 ]--- ... ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
References
Impacted products
Vendor Product Version
Linux Linux Version: 445a25f6e1a2f6a132b06af6ede4f3c9b5f9af68
Version: 445a25f6e1a2f6a132b06af6ede4f3c9b5f9af68
Version: 445a25f6e1a2f6a132b06af6ede4f3c9b5f9af68
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_dim.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7581afc051542e11ccf3ade68acd01b7fb1a3cde",
              "status": "affected",
              "version": "445a25f6e1a2f6a132b06af6ede4f3c9b5f9af68",
              "versionType": "git"
            },
            {
              "lessThan": "2bc6fb90486e42dd80e660ef7a40c02b2516c6d6",
              "status": "affected",
              "version": "445a25f6e1a2f6a132b06af6ede4f3c9b5f9af68",
              "versionType": "git"
            },
            {
              "lessThan": "eb41a264a3a576dc040ee37c3d9d6b7e2d9be968",
              "status": "affected",
              "version": "445a25f6e1a2f6a132b06af6ede4f3c9b5f9af68",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_dim.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix race between DIM disable and net_dim()\n\nThere\u0027s a race between disabling DIM and NAPI callbacks using the dim\npointer on the RQ or SQ.\n\nIf NAPI checks the DIM state bit and sees it still set, it assumes\n`rq-\u003edim` or `sq-\u003edim` is valid. But if DIM gets disabled right after\nthat check, the pointer might already be set to NULL, leading to a NULL\npointer dereference in net_dim().\n\nFix this by calling `synchronize_net()` before freeing the DIM context.\nThis ensures all in-progress NAPI callbacks are finished before the\npointer is cleared.\n\nKernel log:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n...\nRIP: 0010:net_dim+0x23/0x190\n...\nCall Trace:\n \u003cTASK\u003e\n ? __die+0x20/0x60\n ? page_fault_oops+0x150/0x3e0\n ? common_interrupt+0xf/0xa0\n ? sysvec_call_function_single+0xb/0x90\n ? exc_page_fault+0x74/0x130\n ? asm_exc_page_fault+0x22/0x30\n ? net_dim+0x23/0x190\n ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core]\n ? sysvec_apic_timer_interrupt+0xb/0x90\n mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core]\n mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core]\n ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core]\n busy_poll_stop+0xa2/0x200\n ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core]\n ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core]\n __napi_busy_loop+0x345/0x3b0\n ? sysvec_call_function_single+0xb/0x90\n ? asm_sysvec_call_function_single+0x16/0x20\n ? sysvec_apic_timer_interrupt+0xb/0x90\n ? pcpu_free_area+0x1e4/0x2e0\n napi_busy_loop+0x11/0x20\n xsk_recvmsg+0x10c/0x130\n sock_recvmsg+0x44/0x70\n __sys_recvfrom+0xbc/0x130\n ? __schedule+0x398/0x890\n __x64_sys_recvfrom+0x20/0x30\n do_syscall_64+0x4c/0x100\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n...\n---[ end trace 0000000000000000 ]---\n...\n---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-28T04:22:15.952Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7581afc051542e11ccf3ade68acd01b7fb1a3cde"
        },
        {
          "url": "https://git.kernel.org/stable/c/2bc6fb90486e42dd80e660ef7a40c02b2516c6d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb41a264a3a576dc040ee37c3d9d6b7e2d9be968"
        }
      ],
      "title": "net/mlx5e: Fix race between DIM disable and net_dim()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38440",
    "datePublished": "2025-07-25T15:27:19.447Z",
    "dateReserved": "2025-04-16T04:51:24.016Z",
    "dateUpdated": "2025-07-28T04:22:15.952Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38440\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T16:15:29.390\",\"lastModified\":\"2025-07-29T14:14:55.157\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: Fix race between DIM disable and net_dim()\\n\\nThere\u0027s a race between disabling DIM and NAPI callbacks using the dim\\npointer on the RQ or SQ.\\n\\nIf NAPI checks the DIM state bit and sees it still set, it assumes\\n`rq-\u003edim` or `sq-\u003edim` is valid. But if DIM gets disabled right after\\nthat check, the pointer might already be set to NULL, leading to a NULL\\npointer dereference in net_dim().\\n\\nFix this by calling `synchronize_net()` before freeing the DIM context.\\nThis ensures all in-progress NAPI callbacks are finished before the\\npointer is cleared.\\n\\nKernel log:\\n\\nBUG: kernel NULL pointer dereference, address: 0000000000000000\\n...\\nRIP: 0010:net_dim+0x23/0x190\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n ? __die+0x20/0x60\\n ? page_fault_oops+0x150/0x3e0\\n ? common_interrupt+0xf/0xa0\\n ? sysvec_call_function_single+0xb/0x90\\n ? exc_page_fault+0x74/0x130\\n ? asm_exc_page_fault+0x22/0x30\\n ? net_dim+0x23/0x190\\n ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core]\\n ? sysvec_apic_timer_interrupt+0xb/0x90\\n mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core]\\n mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core]\\n ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core]\\n busy_poll_stop+0xa2/0x200\\n ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core]\\n ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core]\\n __napi_busy_loop+0x345/0x3b0\\n ? sysvec_call_function_single+0xb/0x90\\n ? asm_sysvec_call_function_single+0x16/0x20\\n ? sysvec_apic_timer_interrupt+0xb/0x90\\n ? pcpu_free_area+0x1e4/0x2e0\\n napi_busy_loop+0x11/0x20\\n xsk_recvmsg+0x10c/0x130\\n sock_recvmsg+0x44/0x70\\n __sys_recvfrom+0xbc/0x130\\n ? __schedule+0x398/0x890\\n __x64_sys_recvfrom+0x20/0x30\\n do_syscall_64+0x4c/0x100\\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n...\\n---[ end trace 0000000000000000 ]---\\n...\\n---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5e: Se corrige la competencia entre la desactivaci\u00f3n de DIM y net_dim(). Existe una competencia entre la desactivaci\u00f3n de las devoluciones de llamada de DIM y NAPI mediante el puntero dim en el RQ o SQ. Si NAPI comprueba el bit de estado de DIM y lo ve a\u00fan establecido, asume que `rq-\u0026gt;dim` o `sq-\u0026gt;dim` son v\u00e1lidos. Sin embargo, si DIM se desactiva justo despu\u00e9s de dicha comprobaci\u00f3n, es posible que el puntero ya est\u00e9 establecido en NULL, lo que provoca una desreferencia de puntero NULL en net_dim(). Para solucionar esto, llame a `synchronize_net()` antes de liberar el contexto de DIM. Esto garantiza que todas las devoluciones de llamada de NAPI en curso finalicen antes de que se borre el puntero. Kernel log: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:net_dim+0x23/0x190 ... Call Trace:  ? __die+0x20/0x60 ? page_fault_oops+0x150/0x3e0 ? common_interrupt+0xf/0xa0 ? sysvec_call_function_single+0xb/0x90 ? exc_page_fault+0x74/0x130 ? asm_exc_page_fault+0x22/0x30 ? net_dim+0x23/0x190 ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core] ? sysvec_apic_timer_interrupt+0xb/0x90 mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core] mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core] ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core] busy_poll_stop+0xa2/0x200 ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core] ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core] __napi_busy_loop+0x345/0x3b0 ? sysvec_call_function_single+0xb/0x90 ? asm_sysvec_call_function_single+0x16/0x20 ? sysvec_apic_timer_interrupt+0xb/0x90 ? pcpu_free_area+0x1e4/0x2e0 napi_busy_loop+0x11/0x20 xsk_recvmsg+0x10c/0x130 sock_recvmsg+0x44/0x70 __sys_recvfrom+0xbc/0x130 ? __schedule+0x398/0x890 __x64_sys_recvfrom+0x20/0x30 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ... ---[ end trace 0000000000000000 ]--- ... ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2bc6fb90486e42dd80e660ef7a40c02b2516c6d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7581afc051542e11ccf3ade68acd01b7fb1a3cde\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eb41a264a3a576dc040ee37c3d9d6b7e2d9be968\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.