CVE-2025-38150

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

af_packet: move notifier's packet_dev_mc out of rcu critical section

Syzkaller reports the following issue:

BUG: sleeping function called from invalid context at kernel/locking/mutex.c:578

__mutex_lock+0x106/0xe80 kernel/locking/mutex.c:746

team_change_rx_flags+0x38/0x220 drivers/net/team/team_core.c:1781

dev_change_rx_flags net/core/dev.c:9145 [inline]

__dev_set_promiscuity+0x3f8/0x590 net/core/dev.c:9189

netif_set_promiscuity+0x50/0xe0 net/core/dev.c:9201

dev_set_promiscuity+0x126/0x260 net/core/dev_api.c:286 packet_dev_mc net/packet/af_packet.c:3698 [inline]

packet_dev_mclist_delete net/packet/af_packet.c:3722 [inline]

packet_notifier+0x292/0xa60 net/packet/af_packet.c:4247

notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85

call_netdevice_notifiers_extack net/core/dev.c:2214 [inline]

call_netdevice_notifiers net/core/dev.c:2228 [inline]

unregister_netdevice_many_notify+0x15d8/0x2330 net/core/dev.c:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References