Priority Inversion Vulnerability in Linux Kernel: Impacting Debian Packages
Summary
DEBIAN-CVE-2025-38104: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV RLCG Register Access is a way for virtual function... Affects linux versions < 6.12.41-1. Fixed in 6.12.41-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to software applications. It is designed to be efficient, secure, and stable. However, recent vulnerabilities have been identified that could compromise its integrity, particularly in the context of virtualized environments. This specific vulnerability affects the amdgpu driver, which is responsible for managing AMD graphics cards in Linux systems, particularly in scenarios involving SR-IOV (Single Root I/O Virtualization).
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the amdgpu driver related to the RLCG register access. This issue arises from the use of a mutex instead of a spinlock, leading to potential priority inversion. When multiple threads or virtual functions (VFs) attempt to access the same GPU registers simultaneously, it can result in race conditions. The vulnerability is exacerbated when a low-priority task holds a mutex that a high-priority task needs, causing delays and potential system instability. The specific function affected is amdgpu_virt_rlcg_reg_rw, which is critical for register access in a fast code path.
How To Fix
Minimum fixed version
6.12.41-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate risks.
Conclusion
The identified vulnerability in the Linux kernel's amdgpu driver poses significant risks related to priority inversion and race conditions. It is crucial for users to update their systems to the patched versions to ensure stability and security. Utilizing tools like Vulert can further enhance monitoring and alerting for vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves priority inversion due to improper handling of mutexes in the amdgpu driver, which can lead to race conditions and system instability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Failure to address this vulnerability may result in system crashes, degraded performance, and potential security breaches due to race conditions in GPU register access.
Yes, the patched versions are 6.12.41-1 for Debian 13 and 6.16.3-1 for Debian 14. Updating to these versions will mitigate the vulnerability.
Vulert is a platform that monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. It provides real-time alerts and insights into potential vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
