{"id":"DEBIAN-CVE-2025-38440","details":"In the Linux kernel, the following vulnerability has been resolved:  net/mlx5e: Fix race between DIM disable and net_dim()  There's a race between disabling DIM and NAPI callbacks using the dim pointer on the RQ or SQ.  If NAPI checks the DIM state bit and sees it still set, it assumes `rq-\u003edim` or `sq-\u003edim` is valid. But if DIM gets disabled right after that check, the pointer might already be set to NULL, leading to a NULL pointer dereference in net_dim().  Fix this by calling `synchronize_net()` before freeing the DIM context. This ensures all in-progress NAPI callbacks are finished before the pointer is cleared.  Kernel log:  BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:net_dim+0x23/0x190 ... Call Trace:  \u003cTASK\u003e  ? __die+0x20/0x60  ? page_fault_oops+0x150/0x3e0  ? common_interrupt+0xf/0xa0  ? sysvec_call_function_single+0xb/0x90  ? exc_page_fault+0x74/0x130  ? asm_exc_page_fault+0x22/0x30  ? net_dim+0x23/0x190  ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core]  ? sysvec_apic_timer_interrupt+0xb/0x90  mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core]  mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core]  ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core]  busy_poll_stop+0xa2/0x200  ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core]  ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core]  __napi_busy_loop+0x345/0x3b0  ? sysvec_call_function_single+0xb/0x90  ? asm_sysvec_call_function_single+0x16/0x20  ? sysvec_apic_timer_interrupt+0xb/0x90  ? pcpu_free_area+0x1e4/0x2e0  napi_busy_loop+0x11/0x20  xsk_recvmsg+0x10c/0x130  sock_recvmsg+0x44/0x70  __sys_recvfrom+0xbc/0x130  ? __schedule+0x398/0x890  __x64_sys_recvfrom+0x20/0x30  do_syscall_64+0x4c/0x100  entry_SYSCALL_64_after_hwframe+0x4b/0x53 ... ---[ end trace 0000000000000000 ]--- ... ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---","modified":"2026-08-27T23:05:29.872220714Z","published":"2025-07-25T16:15:29.390Z","upstream":["CVE-2025-38440"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-38440"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.41-1"}]}],"versions":["6.12.38-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38440.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16.3-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.3-1~bpo13+1","6.16~rc7-1~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38440.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}