Critical Vulnerability in Linux Kernel: Unsafe Xarray Access in RDMA/Mlx5
Summary
DEBIAN-CVE-2025-38372: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling xa_store() and xa_erase() were used without holding the proper lock, which led to a lockdep... Affects linux versions < 6.12.37-1. Fixed in 6.12.37-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is widely used in various environments, from servers to embedded systems. The kernel's stability and security are paramount, as vulnerabilities can lead to severe system compromises. This specific vulnerability affects the RDMA (Remote Direct Memory Access) subsystem, particularly the mlx5 driver, which is used for high-performance networking.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the RDMA/mlx5 subsystem where unsafe access to the xarray data structure occurred due to improper locking mechanisms. The functions __xa_store() and __xa_erase() were utilized without the necessary locks, leading to potential race conditions and unsafe RCU (Read-Copy-Update) usage. This could result in system instability and security risks, as concurrent access to shared resources may lead to unexpected behavior or crashes.
How To Fix
Minimum fixed version
6.12.37-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described above.
Conclusion
The identified vulnerability in the Linux kernel's RDMA/mlx5 subsystem poses significant risks due to improper locking mechanisms. It is crucial for users to update their systems to the patched version to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves unsafe access to the xarray data structure in the RDMA/mlx5 subsystem of the Linux kernel, which can lead to race conditions.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities in real-time.
If exploited, this vulnerability could lead to system instability, crashes, or unauthorized access to sensitive data.
Yes, versions prior to 6.12.37-1 are affected by this vulnerability.
Detailed information can be found in the Debian CVE database, which provides insights into the vulnerability and its implications.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
