CVE-2025-38374: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38374 is a vulnerability discovered in the Linux kernel's OP-TEE driver implementation, specifically related to the FF-A notifications handling. The issue was disclosed on July 25, 2025, affecting the function notif_callback() which is registered for FF-A notifications (NVD, Red Hat).

The vulnerability occurs when the notif_callback() function is called in an atomic context, leading to sleeping function errors during asynchronous notification processing. The issue manifests as a bug where sleeping functions are called from invalid contexts, specifically at kernel/locking/mutex.c:258. The CVSS v3.1 base score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating moderate severity (Red Hat).

The vulnerability can cause system stability issues when processing asynchronous notifications in the OP-TEE driver. When triggered, it results in kernel errors due to improper context handling, potentially affecting system operations and availability (NVD).

The vulnerability has been resolved by adding a work queue to process the notification in a non-atomic context. This fix ensures proper handling of the FF-A notifications without triggering sleeping function errors (NVD).