CVE-2025-38720

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: hibmcge: fix rtnl deadlock issue

Currently, the hibmcge netdev acquires the rtnl_lock in

pci_error_handlers.reset_prepare() and releases it in

pci_error_handlers.reset_done().

However, in the PCI framework:

pci_reset_bus - __pci_reset_slot - pci_slot_save_and_disable_locked -

pci_dev_save_and_disable - err_handler->reset_prepare(dev);

In pci_slot_save_and_disable_locked():

list_for_each_entry(dev, &slot->bus->devices, bus_list) {

if (!dev->slot || dev->slot!= slot)

continue;

pci_dev_save_and_disable(dev);

if (dev->subordinate)

pci_bus_save_and_disable_locked(dev->subordinate);

}

This will iterate through all devices under the current bus and execute

err_handler->reset_prepare(), causing two devices of the hibmcge driver

to sequentially request the rtnl_lock, leading to a deadlock.

Since the driver now executes netif_device_detach()

before the reset process, it will not concurrently with

other

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References