Critical Vulnerability in Linux Kernel: RDMA/mlx5 Initialization Flaw
Summary
CVE-2025-38387: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert The obj_event may be loaded immediately after inserted, then if the list_head is not init... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its robustness, flexibility, and extensive support for various hardware architectures. However, vulnerabilities can arise, such as the one identified in the RDMA/mlx5 subsystem, which can lead to severe system instability and crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the RDMA/mlx5 subsystem where the obj_event->obj_sub_list is not initialized before being used. This flaw can lead to a NULL pointer dereference, causing a crash in the system. The vulnerability can be exploited when the obj_event is accessed immediately after insertion, potentially leading to a system crash with a poisonous pointer. This issue has been documented with a specific crash log indicating the circumstances under which the error occurs.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The vulnerability identified as CVE-2025-38387 in the Linux kernel's RDMA/mlx5 subsystem poses a significant risk of system crashes due to uninitialized pointers. It is crucial to apply the available patch to ensure system stability and security. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38387 is a vulnerability in the Linux kernel's RDMA/mlx5 subsystem that can lead to system crashes due to uninitialized pointers.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected without needing to install any software.
Exploitation of this vulnerability can lead to system crashes, instability, and potential data loss, impacting the overall reliability of the system.
Yes, a patch is available for Debian 13 in version 6.12.37-1. It is recommended to update to this version to mitigate the vulnerability.
If immediate updating is not possible, monitor your system closely for any signs of instability and consider isolating affected systems from critical operations until the patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
