cbcvebase.
CVE-2025-38104
published 2025-04-18

CVE-2025-38104: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority…

PriorityP419medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.17%
6.8th percentile
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV RLCG Register Access is a way for virtual functions to safely access GPU registers in a virtualized environment., including TLB flushes and register reads. When multiple threads or VFs try to access the same registers simultaneously, it can lead to race conditions. By using the RLCG interface, the driver can serialize access to the registers. This means that only one thread can access the registers at a time, preventing conflicts and ensuring that operations are performed correctly. Additionally, when a low-priority task holds a mutex that a high-priority task needs, ie., If a thread holding a spinlock tries to acquire a mutex, it can lead to priority inversion. register access in amdgpu_virt_rlcg_reg_rw especially in a fast code path is critical. The call stack shows that the function amdgpu_virt_rlcg_reg_rw is being called, which attempts to acquire the mutex. This function is invoked from amdgpu_sriov_wreg, which in turn is called from gmc_v11_0_flush_gpu_tlb. The [ BUG: Invalid wait context ] indicates that a thread is trying to acquire a mutex while it is in a context that does not allow it to sleep (like holding a spinlock). Fixes the below: [ 253.013423] ============================= [ 253.013434] [ BUG: Invalid wait context ] [ 253.013446] 6.12.0-amdstaging-drm-next-lol-050225 #14 Tainted: G U OE [ 253.013464] ----------------------------- [ 253.013475] kworker/0:1/10 is trying to lock: [ 253.013487] ffff9f30542e3cf8 (&adev->virt.rlcg_reg_lock){+.+.}-{3:3}, at: amdgpu_virt_rlcg_reg_rw+0xf6/0x330 [amdgpu] [ 253.013815] other info that might help us debug this: [ 253.013827] context-{4:4} [ 253.013835] 3 locks held by kworker/0:1/10: [ 253.013847] #0: ffff9f3040050f58 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x3f5/0x680 [ 253.013877] #1: ffffb789c008be40 ((work_completio

Affected

38 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
debianlinux-6.1< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
linuxlinux
linuxlinux
linuxlinux>= 1adb5ebe205e96af77a93512e2d5b8c437548787 < d1bda2ab0cf956a16dd369a473a6c43dfbed5855d1bda2ab0cf956a16dd369a473a6c43dfbed5855
linuxlinux>= 6.1.105 < 6.1.1626.1.162
linuxlinux>= 6.10.5 < 6.116.11
linuxlinux>= 6.6.46 < 6.6.1236.6.123
linuxlinux>= e864180ee49b4d30e640fd1e1d852b86411420c9 < 07ed75bfa7ede8bfcfa303fd6efc85db1c8684c707ed75bfa7ede8bfcfa303fd6efc85db1c8684c7
linuxlinux>= e864180ee49b4d30e640fd1e1d852b86411420c9 < 1c0378830e42c98acd69e0289882c8637d92f2851c0378830e42c98acd69e0289882c8637d92f285
linuxlinux>= e864180ee49b4d30e640fd1e1d852b86411420c9 < 5c1741a0c176ae11675a64cb7f2dd21d72db6b915c1741a0c176ae11675a64cb7f2dd21d72db6b91
linuxlinux>= e864180ee49b4d30e640fd1e1d852b86411420c9 < dc0297f3198bd60108ccbd167ee5d9fa4af31ed0dc0297f3198bd60108ccbd167ee5d9fa4af31ed0
linuxlinux>= f39a3bc42815a7016a915f6cb35e9a1448788f06 < dd450b513718dfeb4c637c9335d51a55ebcd4320dd450b513718dfeb4c637c9335d51a55ebcd4320
linuxlinux_kernel>= 0 < 6.1.162-16.1.162-1
linuxlinux_kernel>= 0 < 6.12.41-16.12.41-1
linuxlinux_kernel>= 0 < 6.16.3-16.16.3-1
linuxlinux_kernel>= 0 < 6.8.0-100.1006.8.0-100.100
linuxlinux_kernel>= 0 < 6.14.0-22.226.14.0-22.22
linuxlinux_kernel>= 6.1.105 < 6.26.2
linuxlinux_kernel>= 6.10.5 < 6.12.396.12.39
linuxlinux_kernel>= 6.13 < 6.13.116.13.11
linuxlinux_kernel>= 6.14 < 6.14.26.14.2
linuxlinux_kernel>= 6.6.46 < 6.76.7
msrcazl3_kernel_6.6.104.2-4_on_azure_linux_3.0
msrcazl3_kernel_6.6.112.1-2_on_azure_linux_3.0

CVSS provenance

nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_msrc4.7MEDIUM
vendor_redhat4.7MEDIUM
vendor_ubuntu3.2LOW
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.