CVE-2025-38326: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38326 is a denial-of-service vulnerability in the Linux kernel's ATA over Ethernet (AoE) subsystem caused by improper cleanup of the device request queue (rq_list) when an AoE device is taken down. The flaw was introduced during the conversion to the blk_mq block layer and results in blk_mq_freeze_queue() sleeping indefinitely, causing a system hang. It affects Linux kernel versions from 4.20 through multiple stable branches, with fixed versions including 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, 6.15.4, and 6.16-rc3. The vulnerability was published on July 10, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Kernel Patches).

The root cause is classified as improper resource cleanup (CWE-459 / resource management error) in the aoedev_downdev() function of the Linux kernel's AoE driver. When an AoE device is downed, the rq_list — which holds accepted block I/O requests queued for transmission to the AoE target — was not flushed before blk_mq_freeze_queue() was called. Because blk_mq_freeze_queue() waits for all in-flight requests to complete, the presence of unprocessed requests in rq_list causes it to block indefinitely. The fix cleans out the rq_list prior to invoking blk_mq_freeze_queue(), resolving the hang condition. Exploitation requires local access with low privileges and the ability to trigger AoE device teardown (Feedly, Kernel Patches).

Successful exploitation causes a system hang (indefinite sleep in blk_mq_freeze_queue()), resulting in a denial-of-service condition affecting system availability. There is no impact on confidentiality or data integrity, as the vulnerability is limited to availability. Systems using AoE block devices are at risk of becoming unresponsive when an AoE device is downed while pending requests remain in the queue (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, further limiting the practical attack surface (Feedly).

Apply the appropriate patched Linux kernel version for your branch: 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, 6.15.4, or 6.16-rc3 and later. Ubuntu has issued security notices (USN-7774-1, USN-7775-1, USN-7776-1, USN-7833-1/2/3/4, USN-7856-1) addressing this vulnerability across multiple kernel variants. As a temporary workaround for systems that cannot be patched immediately, restrict local user access and avoid operations that down AoE devices while block requests are pending. Monitor vendor channels (Ubuntu, Red Hat, Debian) for distribution-specific updates (Ubuntu USN-7774-1, Kernel Patches).