Deadlock Vulnerability in Linux Kernel's virtio-net Package
Summary
DEBIAN-CVE-2025-38551: In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix recursived rtnl_lock() during probe() The deadlock appears in a stack trace like: virtnet_probe() rtnl_lock() virtio_config_changed_work... Affects linux versions < 6.12.41-1. Fixed in 6.12.41-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. The virtio-net driver is a critical part of the kernel that facilitates network communication in virtualized environments. This driver allows virtual machines to communicate with the host and other virtual machines efficiently. However, it is susceptible to a deadlock issue during its initialization phase, which can disrupt network operations.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the virtio-net driver, specifically related to the recursive locking of the rtnl_lock() during the probe process. This deadlock occurs when the Virtual Machine Monitor (VMM) sends a VIRTIO_NET_S_ANNOUNCE request while the virtio-net driver is still probing. The resulting stack trace indicates that the driver attempts to acquire the rtnl_lock() multiple times, leading to a deadlock situation. This can severely impact network functionality and stability within virtualized environments.
How To Fix
Minimum fixed version
6.12.41-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The deadlock vulnerability in the virtio-net driver of the Linux kernel poses significant risks to network stability in virtualized environments. It is essential to apply the available patches to ensure the security and functionality of your systems. Utilize tools like Vulert to stay informed about vulnerabilities affecting your applications.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a deadlock issue in the virtio-net driver of the Linux kernel, which can occur during the initialization phase.
This vulnerability can lead to network disruptions in virtualized environments, affecting communication between virtual machines and the host.
Yes, patches are available for Debian 13 and 14. Ensure to update to the specified versions to mitigate the vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without needing to sign up.
While there are no specific workarounds, it is crucial to monitor your systems closely and apply the patch as soon as possible to avoid potential issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
