CVE-2025-38374
BaseFortify
Publication date: 2025-07-25
Last updated on: 2025-11-19
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the OP-TEE driver of the Linux kernel where a function called notif_callback() is executed in an atomic context, which is not allowed to sleep. This leads to kernel errors because the function attempts to perform operations that can sleep, causing instability or crashes. The issue is fixed by changing the code to process notifications in a non-atomic context using a work queue.
How can this vulnerability impact me? :
The vulnerability can cause kernel errors and instability in systems using the affected OP-TEE driver, potentially leading to system crashes or degraded performance due to improper handling of asynchronous notifications in atomic context.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for errors indicating that a sleeping function was called from an atomic context. Specifically, look for messages similar to: 'BUG: sleeping function called from invalid context at kernel/locking/mutex.c:258' along with stack traces involving optee and notif_callback. You can use the command 'dmesg | grep -i "sleeping function called from invalid context"' or 'journalctl -k | grep -i "sleeping function called from invalid context"' to find such errors in the kernel logs.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this issue is fixed. The fix involves processing the OP-TEE FF-A notifications in a non-atomic context by adding a work queue. Until the update is applied, monitoring for the described kernel errors and avoiding workloads that trigger the OP-TEE FF-A notifications may reduce the risk.