GHSA-6GW9-2X6R-HQW8
Vulnerability from github – Published: 2025-07-25 15:30 – Updated: 2025-11-18 21:32In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling
__xa_store() and __xa_erase() were used without holding the proper lock, which led to a lockdep warning due to unsafe RCU usage. This patch replaces them with xa_store() and xa_erase(), which perform the necessary locking internally.
============================= WARNING: suspicious RCPU usage 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Not tainted
./include/linux/xarray.h:1211 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1 3 locks held by kworker/u136:0/219: at: process_one_work+0xbe4/0x15f0 process_one_work+0x75c/0x15f0 pagefault_mr+0x9a5/0x1390 [mlx5_ib]
stack backtrace: CPU: 14 UID: 0 PID: 219 Comm: kworker/u136:0 Not tainted 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib] Call Trace: dump_stack_lvl+0xa8/0xc0 lockdep_rcu_suspicious+0x1e6/0x260 xas_create+0xb8a/0xee0 xas_store+0x73/0x14c0 __xa_store+0x13c/0x220 ? xa_store_range+0x390/0x390 ? spin_bug+0x1d0/0x1d0 pagefault_mr+0xcb5/0x1390 [mlx5_ib] ? _raw_spin_unlock+0x1f/0x30 mlx5_ib_eqe_pf_action+0x3be/0x2620 [mlx5_ib] ? lockdep_hardirqs_on_prepare+0x400/0x400 ? mlx5_ib_invalidate_range+0xcb0/0xcb0 [mlx5_ib] process_one_work+0x7db/0x15f0 ? pwq_dec_nr_in_flight+0xda0/0xda0 ? assign_work+0x168/0x240 worker_thread+0x57d/0xcd0 ? rescuer_thread+0xc40/0xc40 kthread+0x3b3/0x800 ? kthread_is_per_cpu+0xb0/0xb0 ? lock_downgrade+0x680/0x680 ? do_raw_spin_lock+0x12d/0x270 ? spin_bug+0x1d0/0x1d0 ? finish_task_switch.isra.0+0x284/0x9e0 ? lockdep_hardirqs_on_prepare+0x284/0x400 ? kthread_is_per_cpu+0xb0/0xb0 ret_from_fork+0x2d/0x70 ? kthread_is_per_cpu+0xb0/0xb0 ret_from_fork_asm+0x11/0x20
{
"affected": [],
"aliases": [
"CVE-2025-38372"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-25T13:15:26Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix unsafe xarray access in implicit ODP handling\n\n__xa_store() and __xa_erase() were used without holding the proper lock,\nwhich led to a lockdep warning due to unsafe RCU usage. This patch\nreplaces them with xa_store() and xa_erase(), which perform the necessary\nlocking internally.\n\n =============================\n WARNING: suspicious RCPU usage\n 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Not tainted\n -----------------------------\n ./include/linux/xarray.h:1211 suspicious rcu_dereference_protected() usage!\n\n other info that might help us debug this:\n\n rcu_scheduler_active = 2, debug_locks = 1\n 3 locks held by kworker/u136:0/219:\n at: process_one_work+0xbe4/0x15f0\n process_one_work+0x75c/0x15f0\n pagefault_mr+0x9a5/0x1390 [mlx5_ib]\n\n stack backtrace:\n CPU: 14 UID: 0 PID: 219 Comm: kworker/u136:0 Not tainted\n 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\n rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\n Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib]\n Call Trace:\n dump_stack_lvl+0xa8/0xc0\n lockdep_rcu_suspicious+0x1e6/0x260\n xas_create+0xb8a/0xee0\n xas_store+0x73/0x14c0\n __xa_store+0x13c/0x220\n ? xa_store_range+0x390/0x390\n ? spin_bug+0x1d0/0x1d0\n pagefault_mr+0xcb5/0x1390 [mlx5_ib]\n ? _raw_spin_unlock+0x1f/0x30\n mlx5_ib_eqe_pf_action+0x3be/0x2620 [mlx5_ib]\n ? lockdep_hardirqs_on_prepare+0x400/0x400\n ? mlx5_ib_invalidate_range+0xcb0/0xcb0 [mlx5_ib]\n process_one_work+0x7db/0x15f0\n ? pwq_dec_nr_in_flight+0xda0/0xda0\n ? assign_work+0x168/0x240\n worker_thread+0x57d/0xcd0\n ? rescuer_thread+0xc40/0xc40\n kthread+0x3b3/0x800\n ? kthread_is_per_cpu+0xb0/0xb0\n ? lock_downgrade+0x680/0x680\n ? do_raw_spin_lock+0x12d/0x270\n ? spin_bug+0x1d0/0x1d0\n ? finish_task_switch.isra.0+0x284/0x9e0\n ? lockdep_hardirqs_on_prepare+0x284/0x400\n ? kthread_is_per_cpu+0xb0/0xb0\n ret_from_fork+0x2d/0x70\n ? kthread_is_per_cpu+0xb0/0xb0\n ret_from_fork_asm+0x11/0x20",
"id": "GHSA-6gw9-2x6r-hqw8",
"modified": "2025-11-18T21:32:29Z",
"published": "2025-07-25T15:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38372"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2c6b640ea08bff1a192bf87fa45246ff1e40767c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9d2ef890e49963b768d4fe5a33029aacd9f6b93f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ebebffb47c78f63ba7e4fbde393e44af38b7625d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.