CVE-2025-39832
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-12-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.5 (inc) to 6.6.104 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.45 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.16.5 (exc) |
| linux | linux_kernel | 6.17 |
| linux | linux_kernel | 6.17 |
| linux | linux_kernel | 6.17 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-667 | The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a lockdep assertion issue in the Linux kernel's mlx5 driver. It occurs during a synchronous reset unload event when the devlink lock is held twice, causing a double-locking problem. The fix delegates the unload event handling back to the devlink callback process to avoid this double-locking and resolve the lockdep warning.
How can this vulnerability impact me? :
This vulnerability can cause kernel warnings and potentially lead to system instability or crashes due to improper lock handling during device reset events in the mlx5 driver. It affects the reliability of the system when performing synchronous reset unload operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the kernel logs for the specific lockdep assertion warning related to the mlx5 driver. Look for messages similar to: "WARNING: CPU: <cpu> PID: <pid> at devl_assert_locked+0x31/0x40" followed by a call trace involving mlx5_unload_one_devl_locked and mlx5_sync_reset_unload_event. You can use the command 'dmesg | grep devl_assert_locked' or 'journalctl -k | grep devl_assert_locked' to find these warnings in the kernel logs.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the fix for the lockdep assertion on sync reset unload event in the mlx5 driver has been applied. Until the update is applied, avoid triggering the sync reset flow using the devlink reload fw_activate option on affected systems to prevent the double-locking issue.