CVE-2025-38373

一、漏洞信息
 漏洞编号：[CVE-2025-38373](https://nvd.nist.gov/vuln/detail/CVE-2025-38373)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:IB/mlx5: Fix potential deadlock in MR deregistrationThe issue arises when kzalloc() is invoked while holding umem_mutex orany other lock acquired under umem_mutex. This is problematic becausekzalloc() can trigger fs_reclaim_aqcuire(), which may, in turn, invokemmu_notifier_invalidate_range_start(). This function can lead tomlx5_ib_invalidate_range(), which attempts to acquire umem_mutex again,resulting in a deadlock.The problematic flow:             CPU0                      |              CPU1---------------------------------------|------------------------------------------------mlx5_ib_dereg_mr()                     | → revoke_mr()                         |   → mutex_lock(&umem_odp->umem_mutex) |                                       | mlx5_mkey_cache_init()                                       |  → mutex_lock(&dev->cache.rb_lock)                                       |  → mlx5r_cache_create_ent_locked()                                       |    → kzalloc(GFP_KERNEL)                                       |      → fs_reclaim()                                       |        → mmu_notifier_invalidate_range_start()                                       |          → mlx5_ib_invalidate_range()                                       |            → mutex_lock(&umem_odp->umem_mutex)   → cache_ent_find_and_store()        |     → mutex_lock(&dev->cache.rb_lock) |Additionally, when kzalloc() is called from withincache_ent_find_and_store(), we encounter the same deadlock due tore-acquisition of umem_mutex.Solve by releasing umem_mutex in dereg_mr() after umr_revoke_mr()and before acquiring rb_lock. This ensures that we don t holdumem_mutex while performing memory allocations that could triggerthe reclaim path.This change prevents the deadlock by ensuring proper lock ordering andavoiding holding locks during memory allocation operations that couldtrigger the reclaim path.The following lockdep warning demonstrates the deadlock: python3/20557 is trying to acquire lock: ffff888387542128 (&umem_odp->umem_mutex){+.+.}-{4:4}, at: mlx5_ib_invalidate_range+0x5b/0x550 [mlx5_ib] but task is already holding lock: ffffffff82f6b840 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at: unmap_vmas+0x7b/0x1a0 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}:       fs_reclaim_acquire+0x60/0xd0       mem_cgroup_css_alloc+0x6f/0x9b0       cgroup_init_subsys+0xa4/0x240       cgroup_init+0x1c8/0x510       start_kernel+0x747/0x760       x86_64_start_reservations+0x25/0x30       x86_64_start_kernel+0x73/0x80       common_startup_64+0x129/0x138 -> #2 (fs_reclaim){+.+.}-{0:0}:       fs_reclaim_acquire+0x91/0xd0       __kmalloc_cache_noprof+0x4d/0x4c0       mlx5r_cache_create_ent_locked+0x75/0x620 [mlx5_ib]       mlx5_mkey_cache_init+0x186/0x360 [mlx5_ib]       mlx5_ib_stage_post_ib_reg_umr_init+0x3c/0x60 [mlx5_ib]       __mlx5_ib_add+0x4b/0x190 [mlx5_ib]       mlx5r_probe+0xd9/0x320 [mlx5_ib]       auxiliary_bus_probe+0x42/0x70       really_probe+0xdb/0x360       __driver_probe_device+0x8f/0x130       driver_probe_device+0x1f/0xb0       __driver_attach+0xd4/0x1f0       bus_for_each_dev+0x79/0xd0       bus_add_driver+0xf0/0x200       driver_register+0x6e/0xc0       __auxiliary_driver_register+0x6a/0xc0       do_one_initcall+0x5e/0x390       do_init_module+0x88/0x240       init_module_from_file+0x85/0xc0       idempotent_init_module+0x104/0x300       __x64_sys_finit_module+0x68/0xc0       do_syscall_64+0x6d/0x140       entry_SYSCALL_64_after_hwframe+0x4b/0x53 -> #1 (&dev->cache.rb_lock){+.+.}-{4:4}:       __mutex_lock+0x98/0xf10       __mlx5_ib_dereg_mr+0x6f2/0x890 [mlx5_ib]       mlx5_ib_dereg_mr+0x21/0x110 [mlx5_ib]       ib_dereg_mr_user+0x85/0x1f0 [ib_core]  ---truncated---
 漏洞公开时间：2025-07-25 21:15:26
 漏洞创建时间：2025-07-25 21:52:39
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-38373
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://bugzilla.suse.com/1247033 |  |
|  | https://security-tracker.debian.org/tracker/CVE-2025-38373 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2383429 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2025-38373 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025072503-CVE-2025-38373-b6fa@gregkh/T/#u |  |
|  | https://lore.kernel.org/linux-cve-announce/2025072503-CVE-2025-38373-b6fa@gregkh/T |  |
|  | https://git.kernel.org/linus/2ed25aa7f7711f508b6120e336f05cd9d49943c0 |  |
|  | https://ubuntu.com/security/CVE-2025-38373 |  |
|  | https://git.kernel.org/stable/c/727eb1be65a370572edf307558ec3396b8573156 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38373 |  |
|  | https://linux.oracle.com/cve/CVE-2025-38373.html |  |
|  | https://git.kernel.org/stable/c/beb89ada5715e7bd1518c58863eedce89ec051a7 |  |
|  | https://linux.oracle.com/errata/ELSA-2025-20551.html |  |
|  | https://git.kernel.org/stable/c/2ed25aa7f7711f508b6120e336f05cd9d49943c0 |  |
|  | https://www.suse.com/security/cve/CVE-2025-38373.html |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://github.com/gregkh/linux/commit/2ed25aa7f7711f508b6120e336f05cd9d49943c0.patch |  | ljqc |
|  |  | https://git.kernel.org/linus/2ed25aa7f7711f508b6120e336f05cd9d49943c0 |  | osv |
|  |  | https://git.kernel.org/stable/c/727eb1be65a370572edf307558ec3396b8573156 |  | nvd |
|  |  | https://git.kernel.org/stable/c/beb89ada5715e7bd1518c58863eedce89ec051a7 |  | nvd |
|  |  | https://git.kernel.org/stable/c/2ed25aa7f7711f508b6120e336f05cd9d49943c0 |  | nvd |

</details>
 
二、漏洞分析结构反馈
 影响性分析说明：
                                         
 openEuler评分：
   
 受影响版本排查(受影响/不受影响)：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3:
4.openEuler-22.03-LTS-SP4:
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3:
4.openEuler-22.03-LTS-SP4:
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

原因说明：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3:
4.openEuler-22.03-LTS-SP4:
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

src-openEuler/kernel
Closed

Content Risk Flag

Comments (3)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-38373

Comments (3)

Search

src-openEuler/kernel
Closed