CVE-2025-38372

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling

__xa_store() and __xa_erase() were used without holding the proper lock,

which led to a lockdep warning due to unsafe RCU usage. This patch

replaces them with xa_store() and xa_erase(), which perform the necessary

locking internally.

=============================

WARNING: suspicious RCPU usage

6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Not tainted

-----------------------------

./include/linux/xarray.h:1211 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1

3 locks held by kworker/u136:0/219:

at: process_one_work+0xbe4/0x15f0

process_one_work+0x75c/0x15f0

pagefault_mr+0x9a5/0x1390 [mlx5_ib]

stack backtrace:

CPU: 14 UID: 0 PID: 219 Comm: kworker/u136:0 Not tainted

6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1

Hardware name:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References