CVE-2025-38311

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iavf: get rid of the crit lock

Get rid of the crit lock.

That frees us from the error prone logic of try_locks.

Thanks to netdev_lock() by Jakub it is now easy, and in most cases we were

protected by it already - replace crit lock by netdev lock when it was not

the case.

Lockdep reports that we should cancel the work under crit_lock [splat1],

and that was the scheme we have mostly followed since [1] by Slawomir.

But when that is done we still got into deadlocks [splat2]. So instead

we should look at the bigger problem, namely "weird locking/scheduling"

of the iavf. The first step to fix that is to remove the crit lock.

I will followup with a -next series that simplifies scheduling/tasks.

Cancel the work without netdev lock (weird unlock+lock scheme),

to fix the [splat2] (which would be totally ugly if we would kept

the crit lock).

Extend protected part of iavf_watchdog_task() to include scheduling

more work.

Not

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References