CVE-2025-38387
RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert The obj_event may be loaded immediately after inserted, then if the list_head is not initialized then we may get a poisonous pointer. This fixes the crash below: mlx5_core 0000:03:00.0: MLX5E: StrdRq(1) RqSz(8) StrdSz(2048) RxCqeCmprss(0 enhanced) mlx5_core.sf mlx5_core.sf.4: firmware version: 32.38.3056 mlx5_core 0000:03:00.0 en3f0pf0sf2002: renamed from eth0 mlx5_core.sf mlx5_core.sf.4: Rate limit: 127 rates are supported, range: 0Mbps to 195312Mbps IPv6: ADDRCONF(NETDEV_CHANGE): en3f0pf0sf2002: link becomes ready Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060 Mem abort info: ESR = 0x96000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=00000007760fb000 [0000000000000060] pgd=000000076f6d7003, p4d=000000076f6d7003, pud=0000000777841003, pmd=0000000000000000 Internal error: Oops: 96000006 [#1] SMP Modules linked in: ipmb_host(OE) act_mirred(E) cls_flower(E) sch_ingress(E) mptcp_diag(E) udp_diag(E) raw_diag(E) unix_diag(E) tcp_diag(E) inet_diag(E) binfmt_misc(E) bonding(OE) rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) isofs(E) cdrom(E) mst_pciconf(OE) ib_umad(OE) mlx5_ib(OE) ipmb_dev_int(OE) mlx5_core(OE) kpatch_15237886(OEK) mlxdevm(OE) auxiliary(OE) ib_uverbs(OE) ib_core(OE) psample(E) mlxfw(OE) tls(E) sunrpc(E) vfat(E) fat(E) crct10dif_ce(E) ghash_ce(E) sha1_ce(E) sbsa_gwdt(E) virtio_console(E) ext4(E) mbcache(E) jbd2(E) xfs(E) libcrc32c(E) mmc_block(E) virtio_net(E) net_failover(E) failover(E) sha2_ce(E) sha256_arm64(E) nvme(OE) nvme_core(OE) gpio_mlxbf3(OE) mlx_compat(OE) mlxbf_pmc(OE) i2c_mlxbf(OE) sdhci_of_dwcmshc(OE) pinctrl_mlxbf3(OE) mlxbf_pka(OE) gpio_generic(E) i2c_core(E) mmc_core(E) mlxbf_gige(OE) vitesse(E) pwr_mlxbf(OE) mlxbf_tmfifo(OE) micrel(E) mlxbf_bootctl(OE) virtio_ring(E) virtio(E) ipmi_devintf(E) ipmi_msghandler(E) [last unloaded: mst_pci] CPU: 11 PID: 20913 Comm: rte-worker-11 Kdump: loaded Tainted: G OE K 5.10.134-13.1.an8.aarch64 #1 Hardware name: https://www.mellanox.com BlueField-3 SmartNIC Main Card/BlueField-3 SmartNIC Main Card, BIOS 4.2.2.12968 Oct 26 2023 pstate: a0400089 (NzCv daIf +PAN -UAO -TCO BTYPE=--) pc : dispatch_event_fd+0x68/0x300 [mlx5_ib] lr : devx_event_notifier+0xcc/0x228 [mlx5_ib] sp : ffff80001005bcf0 x29: ffff80001005bcf0 x28: 0000000000000001 x27: ffff244e0740a1d8 x26: ffff244e0740a1d0 x25: ffffda56beff5ae0 x24: ffffda56bf911618 x23: ffff244e0596a480 x22: ffff244e0596a480 x21: ffff244d8312ad90 x20: ffff244e0596a480 x19: fffffffffffffff0 x18: 0000000000000000 x17: 0000000000000000 x16: ffffda56be66d620 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000040 x10: ffffda56bfcafb50 x9 : ffffda5655c25f2c x8 : 0000000000000010 x7 : 0000000000000000 x6 : ffff24545a2e24b8 x5 : 0000000000000003 x4 : ffff80001005bd28 x3 : 0000000000000000 x2 : 0000000000000000 x1 : ffff244e0596a480 x0 : ffff244d8312ad90 Call trace: dispatch_event_fd+0x68/0x300 [mlx5_ib] devx_event_notifier+0xcc/0x228 [mlx5_ib] atomic_notifier_call_chain+0x58/0x80 mlx5_eq_async_int+0x148/0x2b0 [mlx5_core] atomic_notifier_call_chain+0x58/0x80 irq_int_handler+0x20/0x30 [mlx5_core] __handle_irq_event_percpu+0x60/0x220 handle_irq_event_percpu+0x3c/0x90 handle_irq_event+0x58/0x158 handle_fasteoi_irq+0xfc/0x188 generic_handle_irq+0x34/0x48 ...
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
| Product | Versions | Authority |
|---|---|---|
| Linux Linux |
≥ 7597385371425febdaa8c6a1da3625d4ffff16f5; < 716b555fc0580c2aa4c2c32ae4401c7e3ad9873e (affected, git) ≥ 7597385371425febdaa8c6a1da3625d4ffff16f5; < 972e968aac0dce8fe8faad54f6106de576695d8e (affected, git) ≥ 7597385371425febdaa8c6a1da3625d4ffff16f5; < 00ed215f593876385451423924fe0358c556179c (affected, git) ≥ 7597385371425febdaa8c6a1da3625d4ffff16f5; < 9a28377a96fb299c180dd9cf0be3b0a038a52d4e (affected, git) ≥ 7597385371425febdaa8c6a1da3625d4ffff16f5; < 23a3b32a274a8d6f33480d0eff436eb100981651 (affected, git) ≥ 7597385371425febdaa8c6a1da3625d4ffff16f5; < 93fccfa71c66a4003b3d2fef3a38de7307e14a4e (affected, git) ≥ 7597385371425febdaa8c6a1da3625d4ffff16f5; < e8069711139249994450c214cec152b917b959e0 (affected, git) ≥ 7597385371425febdaa8c6a1da3625d4ffff16f5; < 8edab8a72d67742f87e9dc2e2b0cdfddda5dc29a (affected, git) Other versions: unaffected |
CNA: Linux |
| Linux Linux |
5.3 (affected) ≥ 0; < 5.3 (unaffected, semver) ≥ 5.4.296; ≤ 5.4.* (unaffected, semver) ≥ 5.10.240; ≤ 5.10.* (unaffected, semver) ≥ 5.15.187; ≤ 5.15.* (unaffected, semver) ≥ 6.1.144; ≤ 6.1.* (unaffected, semver) ≥ 6.6.97; ≤ 6.6.* (unaffected, semver) ≥ 6.12.37; ≤ 6.12.* (unaffected, semver) ≥ 6.15.6; ≤ 6.15.* (unaffected, semver) ≥ 6.16; ≤ * (unaffected, original_commit_for_fix) Other versions: affected |
CNA: Linux |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
No CVSS assessment reported. An unscored record is not a low-severity determination.
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://git.kernel.org/stable/c/716b555fc0580c2aa4c2c32ae4401c7e3ad9873eCNA: Linux
- https://git.kernel.org/stable/c/972e968aac0dce8fe8faad54f6106de576695d8eCNA: Linux
- https://git.kernel.org/stable/c/00ed215f593876385451423924fe0358c556179cCNA: Linux
- https://git.kernel.org/stable/c/9a28377a96fb299c180dd9cf0be3b0a038a52d4eCNA: Linux
- https://git.kernel.org/stable/c/23a3b32a274a8d6f33480d0eff436eb100981651CNA: Linux
- https://git.kernel.org/stable/c/93fccfa71c66a4003b3d2fef3a38de7307e14a4eCNA: Linux
- https://git.kernel.org/stable/c/e8069711139249994450c214cec152b917b959e0CNA: Linux
- https://git.kernel.org/stable/c/8edab8a72d67742f87e9dc2e2b0cdfddda5dc29aCNA: Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlADP: CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlADP: CVE
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.