CVE-2025-38094
BaseFortify
Publication date: 2025-07-03
Last updated on: 2025-12-16
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 3.8 (inc) to 5.10.238 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.184 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.140 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.92 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.30 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.14.8 (exc) |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| debian | debian_linux | 11.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-667 | The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a deadlock issue in the Linux kernel's net: cadence: macb driver. Specifically, after the THALT signal is set high, the TGO signal remains high as well, causing the system to enter a loop where jiffies (a timer value) are never updated because interrupts are disabled. This results in the system never exiting the loop, causing a deadlock where the device remains locked indefinitely. The fix involves using retries instead of relying on jiffies for timeout, preventing the deadlock.
How can this vulnerability impact me? :
This vulnerability can cause a deadlock in devices using the affected Linux kernel driver, leading to the device becoming unresponsive or locked for extended periods (days). This can result in system hangs, degraded performance, or failure of network-related functions on affected hardware, impacting availability and reliability.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by updating the Linux kernel to a version where the macb driver uses retries instead of relying on jiffies for timeout, preventing the deadlock. Therefore, the immediate step is to update your Linux kernel to the patched version that includes this fix.