{"id":"DEBIAN-CVE-2025-38373","details":"In the Linux kernel, the following vulnerability has been resolved:  IB/mlx5: Fix potential deadlock in MR deregistration  The issue arises when kzalloc() is invoked while holding umem_mutex or any other lock acquired under umem_mutex. This is problematic because kzalloc() can trigger fs_reclaim_aqcuire(), which may, in turn, invoke mmu_notifier_invalidate_range_start(). This function can lead to mlx5_ib_invalidate_range(), which attempts to acquire umem_mutex again, resulting in a deadlock.  The problematic flow:              CPU0                      |              CPU1 ---------------------------------------|------------------------------------------------ mlx5_ib_dereg_mr()                     |  → revoke_mr()                         |    → mutex_lock(&umem_odp-\u003eumem_mutex) |                                        | mlx5_mkey_cache_init()                                        |  → mutex_lock(&dev-\u003ecache.rb_lock)                                        |  → mlx5r_cache_create_ent_locked()                                        |    → kzalloc(GFP_KERNEL)                                        |      → fs_reclaim()                                        |        → mmu_notifier_invalidate_range_start()                                        |          → mlx5_ib_invalidate_range()                                        |            → mutex_lock(&umem_odp-\u003eumem_mutex)    → cache_ent_find_and_store()        |      → mutex_lock(&dev-\u003ecache.rb_lock) |  Additionally, when kzalloc() is called from within cache_ent_find_and_store(), we encounter the same deadlock due to re-acquisition of umem_mutex.  Solve by releasing umem_mutex in dereg_mr() after umr_revoke_mr() and before acquiring rb_lock. This ensures that we don't hold umem_mutex while performing memory allocations that could trigger the reclaim path.  This change prevents the deadlock by ensuring proper lock ordering and avoiding holding locks during memory allocation operations that could trigger the reclaim path.  The following lockdep warning demonstrates the deadlock:   python3/20557 is trying to acquire lock:  ffff888387542128 (&umem_odp-\u003eumem_mutex){+.+.}-{4:4}, at:  mlx5_ib_invalidate_range+0x5b/0x550 [mlx5_ib]   but task is already holding lock:  ffffffff82f6b840 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at:  unmap_vmas+0x7b/0x1a0   which lock already depends on the new lock.   the existing dependency chain (in reverse order) is:   -\u003e #3 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}:        fs_reclaim_acquire+0x60/0xd0        mem_cgroup_css_alloc+0x6f/0x9b0        cgroup_init_subsys+0xa4/0x240        cgroup_init+0x1c8/0x510        start_kernel+0x747/0x760        x86_64_start_reservations+0x25/0x30        x86_64_start_kernel+0x73/0x80        common_startup_64+0x129/0x138   -\u003e #2 (fs_reclaim){+.+.}-{0:0}:        fs_reclaim_acquire+0x91/0xd0        __kmalloc_cache_noprof+0x4d/0x4c0        mlx5r_cache_create_ent_locked+0x75/0x620 [mlx5_ib]        mlx5_mkey_cache_init+0x186/0x360 [mlx5_ib]        mlx5_ib_stage_post_ib_reg_umr_init+0x3c/0x60 [mlx5_ib]        __mlx5_ib_add+0x4b/0x190 [mlx5_ib]        mlx5r_probe+0xd9/0x320 [mlx5_ib]        auxiliary_bus_probe+0x42/0x70        really_probe+0xdb/0x360        __driver_probe_device+0x8f/0x130        driver_probe_device+0x1f/0xb0        __driver_attach+0xd4/0x1f0        bus_for_each_dev+0x79/0xd0        bus_add_driver+0xf0/0x200        driver_register+0x6e/0xc0        __auxiliary_driver_register+0x6a/0xc0        do_one_initcall+0x5e/0x390        do_init_module+0x88/0x240        init_module_from_file+0x85/0xc0        idempotent_init_module+0x104/0x300        __x64_sys_finit_module+0x68/0xc0        do_syscall_64+0x6d/0x140        entry_SYSCALL_64_after_hwframe+0x4b/0x53   -\u003e #1 (&dev-\u003ecache.rb_lock){+.+.}-{4:4}:        __mutex_lock+0x98/0xf10        __mlx5_ib_dereg_mr+0x6f2/0x890 [mlx5_ib]        mlx5_ib_dereg_mr+0x21/0x110 [mlx5_ib]        ib_dereg_mr_user+0x85/0x1f0 [ib_core]    ---truncated---","modified":"2026-08-27T23:05:21.710111454Z","published":"2025-07-25T13:15:26.283Z","upstream":["CVE-2025-38373"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-38373"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.37-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38373.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.37-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38373.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}