Kernel Panic Risk in Linux Package Due to IDXD Workqueue Mismanagement
Summary
CVE-2025-38369: In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using Running IDXD workloads in a container with the /dev directory... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux package is a core component of the Debian operating system, responsible for managing system resources and hardware interactions. It provides essential functionalities for process management, memory management, and device control. This vulnerability specifically affects the IDXD (Intel Data Streaming Accelerator) workloads running in containers, where improper handling of workqueues can lead to severe system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the dmaengine related to the idxd workqueue driver. This issue arises when running IDXD workloads in a container with the /dev directory mounted. If the parent process of the container is terminated, it can trigger a call trace or even a kernel panic due to the improper propagation of mount replicas. The vulnerability occurs because the workqueue (wq) is destroyed without checking its availability, leading to attempts to complete pending work on a non-existent workqueue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid running IDXD workloads in containers with the /dev directory mounted until the patch is applied. This can help prevent kernel panics and system instability.
Conclusion
The CVE-2025-38369 vulnerability poses a significant risk to systems running IDXD workloads in containers. It is crucial for users to update their Linux packages to the patched version to ensure system stability and security. Until the update can be applied, users should implement the recommended workaround to mitigate risks.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38369 is a vulnerability in the Linux kernel that can lead to kernel panic when running IDXD workloads in containers under specific conditions.
If your system runs IDXD workloads in containers, it may experience crashes or instability due to improper handling of workqueues.
Yes, a patch is available in version 6.12.37-1 of the Linux package. Users should update to this version to mitigate the risk.
As a temporary measure, avoid running IDXD workloads in containers with the /dev directory mounted to prevent potential kernel panics.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json. You can also check your application for this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
