CVE-2025-38372 — Improper Resource Locking in Linux

CWE-413 — Improper Resource Locking17 documents6 sources
Severity
5.5MEDIUMNVD
OSV5.6
EPSS
0.0%
top 95.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
LinuxLinux KernelDebian Linux
Timeline
PublishedJul 25
Latest updateNov 4

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling __xa_store() and __xa_erase() were used without holding the proper lock, which led to a lockdep warning due to unsafe RCU usage. This patch replaces them with xa_store() and xa_erase(), which perform the necessary locking internally. WARNING: suspicious RCPU usage 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Not tainted ./include/linux/xarray.h:1211 suspicious …

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶NVDlinux/linux_kernel6.12.13 — 6.12.37+2
▶Debianlinux/linux_kernel< 6.12.37-1+1
▶CVEListV5linux/linux7cc8f681f6d4ae4478ae0f60485fc768f2b450da — 9d2ef890e49963b768d4fe5a33029aacd9f6b93f+4
▶debiandebian/linux< linux 6.12.37-1 (forky)

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

8
OSV
linux-hwe-6.14 vulnerabilities↗2025-11-04
▶
OSV
linux-gcp-6.14 vulnerabilities↗2025-10-31
▶
OSV
linux-aws-6.14 vulnerabilities↗2025-10-24
▶
OSV
linux-realtime-6.14 vulnerabilities↗2025-10-22
▶
OSV
linux-azure, linux-azure-6.14, linux-azure-nvidia-6.14 vulnerabilities↗2025-10-22
▶

📋Vendor Advisories

8
Ubuntu
Linux kernel (HWE) vulnerabilities↗2025-11-04
▶
Ubuntu
Linux kernel (GCP) vulnerabilities↗2025-10-31
▶
Ubuntu
Linux kernel (AWS) vulnerabilities↗2025-10-24
▶
Ubuntu
Linux kernel (Azure) vulnerabilities↗2025-10-22
▶
Ubuntu
Linux kernel (Real-time) vulnerabilities↗2025-10-22
▶
CVE-2025-38372 — Improper Resource Locking in Linux | cvebase