GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38372 (GCVE-0-2025-38372)

Vulnerability from cvelistv5 – Published: 2025-07-25 12:53 – Updated: 2026-08-05 12:01
VLAI
Title
RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling __xa_store() and __xa_erase() were used without holding the proper lock, which led to a lockdep warning due to unsafe RCU usage. This patch replaces them with xa_store() and xa_erase(), which perform the necessary locking internally. ============================= WARNING: suspicious RCPU usage 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Not tainted ----------------------------- ./include/linux/xarray.h:1211 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 3 locks held by kworker/u136:0/219: at: process_one_work+0xbe4/0x15f0 process_one_work+0x75c/0x15f0 pagefault_mr+0x9a5/0x1390 [mlx5_ib] stack backtrace: CPU: 14 UID: 0 PID: 219 Comm: kworker/u136:0 Not tainted 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib] Call Trace: dump_stack_lvl+0xa8/0xc0 lockdep_rcu_suspicious+0x1e6/0x260 xas_create+0xb8a/0xee0 xas_store+0x73/0x14c0 __xa_store+0x13c/0x220 ? xa_store_range+0x390/0x390 ? spin_bug+0x1d0/0x1d0 pagefault_mr+0xcb5/0x1390 [mlx5_ib] ? _raw_spin_unlock+0x1f/0x30 mlx5_ib_eqe_pf_action+0x3be/0x2620 [mlx5_ib] ? lockdep_hardirqs_on_prepare+0x400/0x400 ? mlx5_ib_invalidate_range+0xcb0/0xcb0 [mlx5_ib] process_one_work+0x7db/0x15f0 ? pwq_dec_nr_in_flight+0xda0/0xda0 ? assign_work+0x168/0x240 worker_thread+0x57d/0xcd0 ? rescuer_thread+0xc40/0xc40 kthread+0x3b3/0x800 ? kthread_is_per_cpu+0xb0/0xb0 ? lock_downgrade+0x680/0x680 ? do_raw_spin_lock+0x12d/0x270 ? spin_bug+0x1d0/0x1d0 ? finish_task_switch.isra.0+0x284/0x9e0 ? lockdep_hardirqs_on_prepare+0x284/0x400 ? kthread_is_per_cpu+0xb0/0xb0 ret_from_fork+0x2d/0x70 ? kthread_is_per_cpu+0xb0/0xb0 ret_from_fork_asm+0x11/0x20
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7cc8f681f6d4ae4478ae0f60485fc768f2b450da , < 9d2ef890e49963b768d4fe5a33029aacd9f6b93f (git)
Affected: d3d930411ce390e532470194296658a960887773 , < ebebffb47c78f63ba7e4fbde393e44af38b7625d (git)
Affected: d3d930411ce390e532470194296658a960887773 , < 2c6b640ea08bff1a192bf87fa45246ff1e40767c (git)
Affected: edfb65dbb9ffd3102f3ff4dd21316158e56f1976 (git)
Affected: 6.12.13 , < 6.12.37 (semver)
Affected: 6.13.2 , < 6.14 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.12.37 , ≤ 6.12.* (semver)
Unaffected: 6.15.6 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/odp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9d2ef890e49963b768d4fe5a33029aacd9f6b93f",
              "status": "affected",
              "version": "7cc8f681f6d4ae4478ae0f60485fc768f2b450da",
              "versionType": "git"
            },
            {
              "lessThan": "ebebffb47c78f63ba7e4fbde393e44af38b7625d",
              "status": "affected",
              "version": "d3d930411ce390e532470194296658a960887773",
              "versionType": "git"
            },
            {
              "lessThan": "2c6b640ea08bff1a192bf87fa45246ff1e40767c",
              "status": "affected",
              "version": "d3d930411ce390e532470194296658a960887773",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "edfb65dbb9ffd3102f3ff4dd21316158e56f1976",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.37",
              "status": "affected",
              "version": "6.12.13",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14",
              "status": "affected",
              "version": "6.13.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/odp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "6.12.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix unsafe xarray access in implicit ODP handling\n\n__xa_store() and __xa_erase() were used without holding the proper lock,\nwhich led to a lockdep warning due to unsafe RCU usage.  This patch\nreplaces them with xa_store() and xa_erase(), which perform the necessary\nlocking internally.\n\n  =============================\n  WARNING: suspicious RCPU usage\n  6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Not tainted\n  -----------------------------\n  ./include/linux/xarray.h:1211 suspicious rcu_dereference_protected() usage!\n\n  other info that might help us debug this:\n\n  rcu_scheduler_active = 2, debug_locks = 1\n  3 locks held by kworker/u136:0/219:\n      at: process_one_work+0xbe4/0x15f0\n      process_one_work+0x75c/0x15f0\n      pagefault_mr+0x9a5/0x1390 [mlx5_ib]\n\n  stack backtrace:\n  CPU: 14 UID: 0 PID: 219 Comm: kworker/u136:0 Not tainted\n  6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\n  rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\n  Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib]\n  Call Trace:\n   dump_stack_lvl+0xa8/0xc0\n   lockdep_rcu_suspicious+0x1e6/0x260\n   xas_create+0xb8a/0xee0\n   xas_store+0x73/0x14c0\n   __xa_store+0x13c/0x220\n   ? xa_store_range+0x390/0x390\n   ? spin_bug+0x1d0/0x1d0\n   pagefault_mr+0xcb5/0x1390 [mlx5_ib]\n   ? _raw_spin_unlock+0x1f/0x30\n   mlx5_ib_eqe_pf_action+0x3be/0x2620 [mlx5_ib]\n   ? lockdep_hardirqs_on_prepare+0x400/0x400\n   ? mlx5_ib_invalidate_range+0xcb0/0xcb0 [mlx5_ib]\n   process_one_work+0x7db/0x15f0\n   ? pwq_dec_nr_in_flight+0xda0/0xda0\n   ? assign_work+0x168/0x240\n   worker_thread+0x57d/0xcd0\n   ? rescuer_thread+0xc40/0xc40\n   kthread+0x3b3/0x800\n   ? kthread_is_per_cpu+0xb0/0xb0\n   ? lock_downgrade+0x680/0x680\n   ? do_raw_spin_lock+0x12d/0x270\n   ? spin_bug+0x1d0/0x1d0\n   ? finish_task_switch.isra.0+0x284/0x9e0\n   ? lockdep_hardirqs_on_prepare+0x284/0x400\n   ? kthread_is_per_cpu+0xb0/0xb0\n   ret_from_fork+0x2d/0x70\n   ? kthread_is_per_cpu+0xb0/0xb0\n   ret_from_fork_asm+0x11/0x20"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached from local userspace through the RDMA verbs character device `/dev/infiniband/uverbsN` (implicit ODP MR registration plus the `UVERBS_METHOD_ADVISE_MR` prefetch ioctl), which drives `pagefault_mr()` \u2192 `pagefault_implicit_mr()` \u2192 `implicit_get_child_mr()`. While a connected RDMA peer can also drive the same path via hardware page-fault events, the reliable and fully attacker-controlled trigger requires local access to the verbs device.\nAC:L - The attacker controls both sides of the race: two threads each registering their own implicit ODP MR obtain distinct `imr-\u003eimplicit_children` locks, so their concurrent unlocked `__xa_store()`/`__xa_erase()` operations on the shared device-wide `dev-\u003eodp_mkeys` xarray collide with no common serialization, and they additionally race the properly-locked `find_odp_mkey()`/`xa_erase()` users at will.\nPR:L - No capability check exists anywhere on the path \u2014 `mlx5_ib_advise_mr()` and `mlx5_ib_reg_user_mr()` require only an open uverbs FD and a PD handle, and distro rdma-core udev rules expose `/dev/infiniband/uverbs*` world-accessible so unprivileged applications (MPI, GPUDirect) can use RDMA. A plain unprivileged local user therefore suffices.\nUI:N - The attacker performs all steps itself \u2014 registering implicit ODP MRs and issuing concurrent prefetch/page-fault operations \u2014 with no action required from any other user or victim process.\nS:U - The corruption is confined to kernel memory managed by the mlx5_ib driver within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Unsynchronized xarray mutation corrupts the radix-tree structure and leaks stale `struct mlx5_ib_mkey` pointers, which `find_odp_mkey()`/`get_prefetchable_mr()` later dereference and hand to `pagefault_mr()` on freed memory, yielding a use-after-free read primitive over attacker-groomable heap contents.\nI:H - A lost `xa_erase()` defeats the `mlx5r_deref_wait_odp_mkey()` guard in `__mlx5_ib_dereg_mr()`, so freed MR objects are still written through (`refcount_inc(\u0026mmkey-\u003eusecount)`, XLT updates), and racing `xas_store()`/`xas_create()` can write into concurrently freed `xa_node` memory \u2014 both give attacker-influenced write primitives suitable for control-flow hijacking.\nA:H - The race produces radix-tree corruption, double-free/use-after-free of xarray nodes and MR objects, and the `WARN_ON(!xa_empty(\u0026dev-\u003eodp_mkeys))` at device teardown \u2014 any of which oops or panic the kernel, and the attacker can repeat the trigger indefinitely."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:25.586Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9d2ef890e49963b768d4fe5a33029aacd9f6b93f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebebffb47c78f63ba7e4fbde393e44af38b7625d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c6b640ea08bff1a192bf87fa45246ff1e40767c"
        }
      ],
      "title": "RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38372",
    "datePublished": "2025-07-25T12:53:15.255Z",
    "dateReserved": "2025-04-16T04:51:24.009Z",
    "dateUpdated": "2026-08-05T12:01:25.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38372",
      "date": "2026-09-16",
      "epss": "0.00156",
      "percentile": "0.05191"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38372\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T13:15:26.173\",\"lastModified\":\"2026-07-30T06:23:10.733\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/mlx5: Fix unsafe xarray access in implicit ODP handling\\n\\n__xa_store() and __xa_erase() were used without holding the proper lock,\\nwhich led to a lockdep warning due to unsafe RCU usage.  This patch\\nreplaces them with xa_store() and xa_erase(), which perform the necessary\\nlocking internally.\\n\\n  =============================\\n  WARNING: suspicious RCPU usage\\n  6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Not tainted\\n  -----------------------------\\n  ./include/linux/xarray.h:1211 suspicious rcu_dereference_protected() usage!\\n\\n  other info that might help us debug this:\\n\\n  rcu_scheduler_active = 2, debug_locks = 1\\n  3 locks held by kworker/u136:0/219:\\n      at: process_one_work+0xbe4/0x15f0\\n      process_one_work+0x75c/0x15f0\\n      pagefault_mr+0x9a5/0x1390 [mlx5_ib]\\n\\n  stack backtrace:\\n  CPU: 14 UID: 0 PID: 219 Comm: kworker/u136:0 Not tainted\\n  6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1\\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\\n  rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\\n  Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib]\\n  Call Trace:\\n   dump_stack_lvl+0xa8/0xc0\\n   lockdep_rcu_suspicious+0x1e6/0x260\\n   xas_create+0xb8a/0xee0\\n   xas_store+0x73/0x14c0\\n   __xa_store+0x13c/0x220\\n   ? xa_store_range+0x390/0x390\\n   ? spin_bug+0x1d0/0x1d0\\n   pagefault_mr+0xcb5/0x1390 [mlx5_ib]\\n   ? _raw_spin_unlock+0x1f/0x30\\n   mlx5_ib_eqe_pf_action+0x3be/0x2620 [mlx5_ib]\\n   ? lockdep_hardirqs_on_prepare+0x400/0x400\\n   ? mlx5_ib_invalidate_range+0xcb0/0xcb0 [mlx5_ib]\\n   process_one_work+0x7db/0x15f0\\n   ? pwq_dec_nr_in_flight+0xda0/0xda0\\n   ? assign_work+0x168/0x240\\n   worker_thread+0x57d/0xcd0\\n   ? rescuer_thread+0xc40/0xc40\\n   kthread+0x3b3/0x800\\n   ? kthread_is_per_cpu+0xb0/0xb0\\n   ? lock_downgrade+0x680/0x680\\n   ? do_raw_spin_lock+0x12d/0x270\\n   ? spin_bug+0x1d0/0x1d0\\n   ? finish_task_switch.isra.0+0x284/0x9e0\\n   ? lockdep_hardirqs_on_prepare+0x284/0x400\\n   ? kthread_is_per_cpu+0xb0/0xb0\\n   ret_from_fork+0x2d/0x70\\n   ? kthread_is_per_cpu+0xb0/0xb0\\n   ret_from_fork_asm+0x11/0x20\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/mlx5: Se corrige el acceso inseguro a la matriz x en la gesti\u00f3n impl\u00edcita de ODP. __xa_store() y __xa_erase() se usaban sin mantener el bloqueo adecuado, lo que generaba una advertencia de bloqueo debido al uso inseguro de RCU. Este parche los reemplaza con xa_store() y xa_erase(), que realizan el bloqueo necesario internamente. ============================= WARNING: suspicious RCPU usage 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Not tainted ----------------------------- ./include/linux/xarray.h:1211 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 3 locks held by kworker/u136:0/219: at: process_one_work+0xbe4/0x15f0 process_one_work+0x75c/0x15f0 pagefault_mr+0x9a5/0x1390 [mlx5_ib] stack backtrace: CPU: 14 UID: 0 PID: 219 Comm: kworker/u136:0 Not tainted 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib] Call Trace: dump_stack_lvl+0xa8/0xc0 lockdep_rcu_suspicious+0x1e6/0x260 xas_create+0xb8a/0xee0 xas_store+0x73/0x14c0 __xa_store+0x13c/0x220 ? xa_store_range+0x390/0x390 ? spin_bug+0x1d0/0x1d0 pagefault_mr+0xcb5/0x1390 [mlx5_ib] ? _raw_spin_unlock+0x1f/0x30 mlx5_ib_eqe_pf_action+0x3be/0x2620 [mlx5_ib] ? lockdep_hardirqs_on_prepare+0x400/0x400 ? mlx5_ib_invalidate_range+0xcb0/0xcb0 [mlx5_ib] process_one_work+0x7db/0x15f0 ? pwq_dec_nr_in_flight+0xda0/0xda0 ? assign_work+0x168/0x240 worker_thread+0x57d/0xcd0 ? rescuer_thread+0xc40/0xc40 kthread+0x3b3/0x800 ? kthread_is_per_cpu+0xb0/0xb0 ? lock_downgrade+0x680/0x680 ? do_raw_spin_lock+0x12d/0x270 ? spin_bug+0x1d0/0x1d0 ? finish_task_switch.isra.0+0x284/0x9e0 ? lockdep_hardirqs_on_prepare+0x284/0x400 ? kthread_is_per_cpu+0xb0/0xb0 ret_from_fork+0x2d/0x70 ? kthread_is_per_cpu+0xb0/0xb0 ret_from_fork_asm+0x11/0x20\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/hw/mlx5/odp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7cc8f681f6d4ae4478ae0f60485fc768f2b450da\",\"lessThan\":\"9d2ef890e49963b768d4fe5a33029aacd9f6b93f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d3d930411ce390e532470194296658a960887773\",\"lessThan\":\"ebebffb47c78f63ba7e4fbde393e44af38b7625d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d3d930411ce390e532470194296658a960887773\",\"lessThan\":\"2c6b640ea08bff1a192bf87fa45246ff1e40767c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"edfb65dbb9ffd3102f3ff4dd21316158e56f1976\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.12.13\",\"lessThan\":\"6.12.37\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.13.2\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/hw/mlx5/odp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.37\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.6\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.13\",\"versionEndExcluding\":\"6.12.37\",\"matchCriteriaId\":\"DA756C3C-6B87-47A8-A940-075165D790A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13.2\",\"versionEndExcluding\":\"6.15.6\",\"matchCriteriaId\":\"F76D2C3E-0DE1-42FD-9304-0E4C60DE0088\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2c6b640ea08bff1a192bf87fa45246ff1e40767c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9d2ef890e49963b768d4fe5a33029aacd9f6b93f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ebebffb47c78f63ba7e4fbde393e44af38b7625d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:13:12+00:00",
      "cve": "CVE-2025-38372",
      "id": "CVE-2025-38372",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service due to unsafe xarray access in RDMA/mlx5",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38372.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T17:01:29Z",
      "cve": "CVE-2025-38372",
      "id": "CVE-2025-38372",
      "initial_release_date": "2025-07-25T23:23:19Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "448",
      "product_status:recommended": "154",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38372",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38372.json",
      "version": "24"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.