{"id":"DEBIAN-CVE-2025-38372","details":"In the Linux kernel, the following vulnerability has been resolved:  RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling  __xa_store() and __xa_erase() were used without holding the proper lock, which led to a lockdep warning due to unsafe RCU usage.  This patch replaces them with xa_store() and xa_erase(), which perform the necessary locking internally.    =============================   WARNING: suspicious RCPU usage   6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Not tainted   -----------------------------   ./include/linux/xarray.h:1211 suspicious rcu_dereference_protected() usage!    other info that might help us debug this:    rcu_scheduler_active = 2, debug_locks = 1   3 locks held by kworker/u136:0/219:       at: process_one_work+0xbe4/0x15f0       process_one_work+0x75c/0x15f0       pagefault_mr+0x9a5/0x1390 [mlx5_ib]    stack backtrace:   CPU: 14 UID: 0 PID: 219 Comm: kworker/u136:0 Not tainted   6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS   rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014   Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib]   Call Trace:    dump_stack_lvl+0xa8/0xc0    lockdep_rcu_suspicious+0x1e6/0x260    xas_create+0xb8a/0xee0    xas_store+0x73/0x14c0    __xa_store+0x13c/0x220    ? xa_store_range+0x390/0x390    ? spin_bug+0x1d0/0x1d0    pagefault_mr+0xcb5/0x1390 [mlx5_ib]    ? _raw_spin_unlock+0x1f/0x30    mlx5_ib_eqe_pf_action+0x3be/0x2620 [mlx5_ib]    ? lockdep_hardirqs_on_prepare+0x400/0x400    ? mlx5_ib_invalidate_range+0xcb0/0xcb0 [mlx5_ib]    process_one_work+0x7db/0x15f0    ? pwq_dec_nr_in_flight+0xda0/0xda0    ? assign_work+0x168/0x240    worker_thread+0x57d/0xcd0    ? rescuer_thread+0xc40/0xc40    kthread+0x3b3/0x800    ? kthread_is_per_cpu+0xb0/0xb0    ? lock_downgrade+0x680/0x680    ? do_raw_spin_lock+0x12d/0x270    ? spin_bug+0x1d0/0x1d0    ? finish_task_switch.isra.0+0x284/0x9e0    ? lockdep_hardirqs_on_prepare+0x284/0x400    ? kthread_is_per_cpu+0xb0/0xb0    ret_from_fork+0x2d/0x70    ? kthread_is_per_cpu+0xb0/0xb0    ret_from_fork_asm+0x11/0x20","modified":"2026-08-27T23:05:29.868375852Z","published":"2025-07-25T13:15:26.173Z","upstream":["CVE-2025-38372"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-38372"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.37-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38372.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.37-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38372.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}