CVE-2025-38440
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38440
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38440.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-38440
- Downstream
- Published
- 2025-07-25T15:27:19Z
- Modified
- 2025-10-18T04:10:12.723927Z
- Summary
- net/mlx5e: Fix race between DIM disable and net_dim()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix race between DIM disable and net_dim()
There's a race between disabling DIM and NAPI callbacks using the dim pointer on the RQ or SQ.
If NAPI checks the DIM state bit and sees it still set, it assumes
rq->dimorsq->dimis valid. But if DIM gets disabled right after that check, the pointer might already be set to NULL, leading to a NULL pointer dereference in net_dim().Fix this by calling
synchronize_net()before freeing the DIM context. This ensures all in-progress NAPI callbacks are finished before the pointer is cleared.Kernel log:
BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:netdim+0x23/0x190 ... Call Trace: <TASK> ? _die+0x20/0x60 ? pagefaultoops+0x150/0x3e0 ? commoninterrupt+0xf/0xa0 ? sysveccallfunctionsingle+0xb/0x90 ? excpagefault+0x74/0x130 ? asmexcpagefault+0x22/0x30 ? netdim+0x23/0x190 ? mlx5epollicocq+0x41/0x6f0 [mlx5core] ? sysvecapictimerinterrupt+0xb/0x90 mlx5ehandlerxdim+0x92/0xd0 [mlx5core] mlx5enapipoll+0x2cd/0xac0 [mlx5core] ? mlx5epollicocq+0xe5/0x6f0 [mlx5core] busypollstop+0xa2/0x200 ? mlx5enapipoll+0x1d9/0xac0 [mlx5core] ? mlx5etriggerirq+0x130/0x130 [mlx5core] _napibusyloop+0x345/0x3b0 ? sysveccallfunctionsingle+0xb/0x90 ? asmsysveccallfunctionsingle+0x16/0x20 ? sysvecapictimerinterrupt+0xb/0x90 ? pcpufreearea+0x1e4/0x2e0 napibusyloop+0x11/0x20 xskrecvmsg+0x10c/0x130 sockrecvmsg+0x44/0x70 _sysrecvfrom+0xbc/0x130 ? _schedule+0x398/0x890 _x64sysrecvfrom+0x20/0x30 dosyscall64+0x4c/0x100 entrySYSCALL64after_hwframe+0x4b/0x53 ... ---[ end trace 0000000000000000 ]--- ... ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced445a25f6e1a2f6a132b06af6ede4f3c9b5f9af68Fixed7581afc051542e11ccf3ade68acd01b7fb1a3cde
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced445a25f6e1a2f6a132b06af6ede4f3c9b5f9af68Fixed2bc6fb90486e42dd80e660ef7a40c02b2516c6d6
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced445a25f6e1a2f6a132b06af6ede4f3c9b5f9af68Fixedeb41a264a3a576dc040ee37c3d9d6b7e2d9be968
Affected versions
v6.*
Database specific
vanir_signatures
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 541.0,
"function_hash": "163856176882858545771066404221688252094"
},
"signature_type": "Function",
"id": "CVE-2025-38440-0f2000de",
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_dim.c",
"function": "mlx5e_dim_rx_change"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb41a264a3a576dc040ee37c3d9d6b7e2d9be968"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"113128486502230908698635460341927465986",
"289111525224891289807938470642463585507",
"256543547925866347218525490214453350066",
"253192750045648341228949938016243361116",
"91657909720455931378858947879419273680",
"169081702823974026284947782296129461725"
]
},
"signature_type": "Line",
"id": "CVE-2025-38440-5aa1364c",
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_dim.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7581afc051542e11ccf3ade68acd01b7fb1a3cde"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 541.0,
"function_hash": "134857586411720895103412947079653213104"
},
"signature_type": "Function",
"id": "CVE-2025-38440-5aa5efbd",
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_dim.c",
"function": "mlx5e_dim_tx_change"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bc6fb90486e42dd80e660ef7a40c02b2516c6d6"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 541.0,
"function_hash": "163856176882858545771066404221688252094"
},
"signature_type": "Function",
"id": "CVE-2025-38440-7fcccab8",
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_dim.c",
"function": "mlx5e_dim_rx_change"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bc6fb90486e42dd80e660ef7a40c02b2516c6d6"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 541.0,
"function_hash": "134857586411720895103412947079653213104"
},
"signature_type": "Function",
"id": "CVE-2025-38440-97fbe603",
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_dim.c",
"function": "mlx5e_dim_tx_change"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb41a264a3a576dc040ee37c3d9d6b7e2d9be968"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 541.0,
"function_hash": "134857586411720895103412947079653213104"
},
"signature_type": "Function",
"id": "CVE-2025-38440-99c4f3fe",
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_dim.c",
"function": "mlx5e_dim_tx_change"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7581afc051542e11ccf3ade68acd01b7fb1a3cde"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 541.0,
"function_hash": "163856176882858545771066404221688252094"
},
"signature_type": "Function",
"id": "CVE-2025-38440-e1beb455",
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_dim.c",
"function": "mlx5e_dim_rx_change"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7581afc051542e11ccf3ade68acd01b7fb1a3cde"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"113128486502230908698635460341927465986",
"289111525224891289807938470642463585507",
"256543547925866347218525490214453350066",
"253192750045648341228949938016243361116",
"91657909720455931378858947879419273680",
"169081702823974026284947782296129461725"
]
},
"signature_type": "Line",
"id": "CVE-2025-38440-f19c9d04",
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_dim.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bc6fb90486e42dd80e660ef7a40c02b2516c6d6"
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"113128486502230908698635460341927465986",
"289111525224891289807938470642463585507",
"256543547925866347218525490214453350066",
"253192750045648341228949938016243361116",
"91657909720455931378858947879419273680",
"169081702823974026284947782296129461725"
]
},
"signature_type": "Line",
"id": "CVE-2025-38440-f5c9fba3",
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_dim.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb41a264a3a576dc040ee37c3d9d6b7e2d9be968"
}
]