CVE-2025-38372: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38372 is a denial-of-service vulnerability in the Linux kernel's RDMA/mlx5 subsystem caused by unsafe xarray access in implicit On-Demand Paging (ODP) handling. The flaw was disclosed on July 25, 2025, and affects Linux kernel versions 6.12.13 through 6.12.37 (exclusive), 6.13.2 through 6.15.6 (exclusive), and 6.16 release candidates rc1 through rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper locking (CWE-667: Improper Locking) in the mlx5_ib kernel module's implicit ODP page fault handler. Specifically, __xa_store() and __xa_erase() were called without holding the required xarray lock, resulting in unsafe RCU (Read-Copy-Update) dereference as flagged by lockdep. The vulnerable code path is triggered via the pagefault_mr function within the mlx5_ib_eqe_pf_action workqueue handler, which processes page fault events for RDMA memory regions. The fix replaces the unlocked __xa_store()/__xa_erase() calls with their locking counterparts xa_store() and xa_erase() (Red Hat Bugzilla, Kernel Patches).

Successful exploitation by a local, low-privileged attacker could cause system instability or a denial-of-service condition on systems equipped with Mellanox/NVIDIA mlx5 RDMA network interfaces. The vulnerability has high availability impact with no confidentiality or integrity impact, meaning an attacker cannot use it to access or modify data, but can disrupt system operations or render the system unresponsive. The scope is limited to the affected host and does not provide a path for lateral movement or privilege escalation on its own (Red Hat Advisory, Red Hat Bugzilla).

• Logs: Kernel log entries containing WARNING: suspicious RCU usage or suspicious rcu_dereference_protected() usage originating from xarray.h or the mlx5_ib module.
• Logs: Stack traces in kernel logs referencing pagefault_mr, mlx5_ib_eqe_pf_action, __xa_store, or xas_create within the mlx5_ib workqueue context.
• Process: Unusual stalls or hangs in kworker threads associated with the mlx5_ib_page_fault workqueue.
• System: Unexpected system instability, kernel panics, or unresponsiveness on hosts with Mellanox/NVIDIA mlx5 RDMA adapters running affected kernel versions (Red Hat Bugzilla).

Update the Linux kernel to a patched version: 6.12.37 or later for the 6.12 stable series, or 6.15.6 or later for the 6.15 series. Ubuntu has released security notices USN-7833-1 through USN-7833-4 addressing this vulnerability. Red Hat has tracked the issue via Bugzilla (Bug 2383437) and patches are available from the Linux kernel stable repositories. As a temporary measure where patching is not immediately possible, restricting local user access on systems with mlx5 RDMA hardware reduces exposure. Monitor kernel logs for RCU/xarray-related warnings as an indicator of potential triggering (Red Hat Bugzilla, Kernel Patches, Ubuntu USN-7833-1).