{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"9a36715cd6bc6a6f16230e19a7f947bab34b3fe5","status":"affected","version":"a251eee62133774cf35ff829041377e721ef9c8c","versionType":"git"},{"lessThan":"dc6c3c2c9dfdaa3a3357f59a80a2904677a71a9a","status":"affected","version":"a251eee62133774cf35ff829041377e721ef9c8c","versionType":"git"},{"lessThan":"b2beb5bb2cd90d7939e470ed4da468683f41baa3","status":"affected","version":"a251eee62133774cf35ff829041377e721ef9c8c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.37","versionType":"semver"},{"lessThanOrEqual":"6.15.*","status":"unaffected","version":"6.15.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.16","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2025-38392","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: convert control queue mutex to a spinlock\n\nWith VIRTCHNL2_CAP_MACFILTER enabled, the following warning is generated\non module load:\n\n[  324.701677] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:578\n[  324.701684] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1582, name: NetworkManager\n[  324.701689] preempt_count: 201, expected: 0\n[  324.701693] RCU nest depth: 0, expected: 0\n[  324.701697] 2 locks held by NetworkManager/1582:\n[  324.701702]  #0: ffffffff9f7be770 (rtnl_mutex){....}-{3:3}, at: rtnl_newlink+0x791/0x21e0\n[  324.701730]  #1: ff1100216c380368 (_xmit_ETHER){....}-{2:2}, at: __dev_open+0x3f0/0x870\n[  324.701749] Preemption disabled at:\n[  324.701752] [<ffffffff9cd23b9d>] __dev_open+0x3dd/0x870\n[  324.701765] CPU: 30 UID: 0 PID: 1582 Comm: NetworkManager Not tainted 6.15.0-rc5+ #2 PREEMPT(voluntary)\n[  324.701771] Hardware name: Intel Corporation M50FCP2SBSTD/M50FCP2SBSTD, BIOS SE5C741.86B.01.01.0001.2211140926 11/14/2022\n[  324.701774] Call Trace:\n[  324.701777]  <TASK>\n[  324.701779]  dump_stack_lvl+0x5d/0x80\n[  324.701788]  ? __dev_open+0x3dd/0x870\n[  324.701793]  __might_resched.cold+0x1ef/0x23d\n<..>\n[  324.701818]  __mutex_lock+0x113/0x1b80\n<..>\n[  324.701917]  idpf_ctlq_clean_sq+0xad/0x4b0 [idpf]\n[  324.701935]  ? kasan_save_track+0x14/0x30\n[  324.701941]  idpf_mb_clean+0x143/0x380 [idpf]\n<..>\n[  324.701991]  idpf_send_mb_msg+0x111/0x720 [idpf]\n[  324.702009]  idpf_vc_xn_exec+0x4cc/0x990 [idpf]\n[  324.702021]  ? rcu_is_watching+0x12/0xc0\n[  324.702035]  idpf_add_del_mac_filters+0x3ed/0xb50 [idpf]\n<..>\n[  324.702122]  __hw_addr_sync_dev+0x1cf/0x300\n[  324.702126]  ? find_held_lock+0x32/0x90\n[  324.702134]  idpf_set_rx_mode+0x317/0x390 [idpf]\n[  324.702152]  __dev_open+0x3f8/0x870\n[  324.702159]  ? __pfx___dev_open+0x10/0x10\n[  324.702174]  __dev_change_flags+0x443/0x650\n<..>\n[  324.702208]  netif_change_flags+0x80/0x160\n[  324.702218]  do_setlink.isra.0+0x16a0/0x3960\n<..>\n[  324.702349]  rtnl_newlink+0x12fd/0x21e0\n\nThe sequence is as follows:\n\trtnl_newlink()->\n\t__dev_change_flags()->\n\t__dev_open()->\n\tdev_set_rx_mode() - >  # disables BH and grabs \"dev->addr_list_lock\"\n\tidpf_set_rx_mode() ->  # proceed only if VIRTCHNL2_CAP_MACFILTER is ON\n\t__dev_uc_sync() ->\n\tidpf_add_mac_filter ->\n\tidpf_add_del_mac_filters ->\n\tidpf_send_mb_msg() ->\n\tidpf_mb_clean() ->\n\tidpf_ctlq_clean_sq()   # mutex_lock(cq_lock)\n\nFix by converting cq_lock to a spinlock. All operations under the new\nlock are safe except freeing the DMA memory, which may use vunmap(). Fix\nby requesting a contiguous physical memory for the DMA mapping.","epss":{"date":"2026-11-05","percentile":0.08654,"score":0.00189},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793912556481,"publishedAt":1753448017175,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/9a36715cd6bc6a6f16230e19a7f947bab34b3fe5"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/dc6c3c2c9dfdaa3a3357f59a80a2904677a71a9a"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/b2beb5bb2cd90d7939e470ed4da468683f41baa3"}],"remediation":[],"revision":"686a790ef632ebf85b93dc1a8e8dac7b90e26785d2c115a538a822c574a6ba76","sources":[{"modifiedAt":1793912556481,"name":"CNA: Linux","retrievedAt":1793913684926,"url":"https://www.cve.org/CVERecord?id=CVE-2025-38392"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793913705752,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-38392"}],"ssvc":{"assessedAt":1793912159686,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"idpf: convert control queue mutex to a spinlock","updatedAt":1793913705752}