CVE-2025-38005: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38005 is a missing locking vulnerability in the Linux kernel's DMA engine driver for Texas Instruments (TI) K3 UDMA (dmaengine: ti: k3-udma). The flaw causes the kernel's lock validator to emit warnings when the udma_start function is called without holding the required lock, potentially leading to race conditions and system instability. It was published on June 18, 2025, and affects Linux kernel versions from 5.6 through multiple stable branches up to 6.14.x and 6.15 release candidates. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a missing mutex/spinlock acquisition in the udma_start function within drivers/dma/ti/k3-udma.c, classified as CWE-667 (Improper Locking). When the kernel's lock validator (lockdep) is enabled, a WARNING is triggered at virt-dma.h:169 during DMA TX completion processing via the udma_check_tx_completion workqueue, indicating that the function accesses shared state without holding the required lock. The attack vector is local and requires low privileges, as an attacker or process with local access could trigger the race condition by interacting with DMA operations on affected TI K3-based hardware. Patches are available across multiple stable kernel trees (Feedly, Kernel Patch).

Successful exploitation of this vulnerability primarily affects system availability, with no direct confidentiality or integrity impact. The missing lock can cause race conditions in the DMA engine subsystem, potentially resulting in kernel warnings, unexpected behavior, or kernel panics on systems using TI K3 UDMA hardware (e.g., embedded ARM64 platforms). The scope is limited to the local system and does not provide a direct path for lateral movement or data exfiltration (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained to local access on systems with TI K3 UDMA hardware, significantly limiting the attack surface (Feedly).

Patches have been released for all affected stable kernel branches. Administrators should update to the following fixed versions or later: 5.10.238, 5.15.184, 6.1.140, 6.6.92, 6.12.30, or 6.14.8. Upstream patches are available in the Linux stable kernel repository. For systems that cannot be immediately patched, limiting local user access and monitoring for kernel warning messages (particularly WARNING entries referencing udma_start or virt-dma.h) can reduce risk. Vendor-specific updates have been issued by SUSE, Ubuntu, and Debian (Ubuntu USN-7655-1, Debian LTS, Kernel Patch).