CVE-2025-38387

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert

The obj_event may be loaded immediately after inserted, then if the

list_head is not initialized then we may get a poisonous pointer. This

fixes the crash below:

mlx5_core 0000:03:00.0: MLX5E: StrdRq(1) RqSz(8) StrdSz(2048) RxCqeCmprss(0 enhanced)

mlx5_core.sf mlx5_core.sf.4: firmware version: 32.38.3056

mlx5_core 0000:03:00.0 en3f0pf0sf2002: renamed from eth0

mlx5_core.sf mlx5_core.sf.4: Rate limit: 127 rates are supported, range: 0Mbps to 195312Mbps

IPv6: ADDRCONF(NETDEV_CHANGE): en3f0pf0sf2002: link becomes ready

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060

Mem abort info:

ESR = 0x96000006

EC = 0x25: DABT (current EL), IL = 32 bits

SET = 0, FnV = 0

EA = 0, S1PTW = 0

Data abort info:

ISV = 0, ISS = 0x00000006

CM = 0, WnR = 0

user pgtable: 4k pages, 48-bit VAs, pgdp=00000007760fb000

[0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References