CVE-2025-38392: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38392 is a locking bug in the Linux kernel's Intel Dynamic Packet Forwarding (idpf) network driver, where the control queue mutex (cq_lock) is incorrectly acquired from an atomic context, triggering a kernel BUG warning about sleeping functions called from invalid contexts. The issue manifests when VIRTCHNL2_CAP_MACFILTER is enabled and NetworkManager attempts to open a network interface, causing preemption-disabled code paths to call mutex_lock(). Affected kernel versions include 6.7 through 6.12.36 and 6.13 through 6.15.5, as well as release candidates 6.16-rc1 through 6.16-rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper locking context (CWE-667: Improper Locking): the idpf driver's control queue uses a mutex (cq_lock) that is acquired during the call chain rtnl_newlink() → __dev_change_flags() → __dev_open() → dev_set_rx_mode() → idpf_set_rx_mode() → idpf_add_del_mac_filters() → idpf_send_mb_msg() → idpf_mb_clean() → idpf_ctlq_clean_sq(). At the point idpf_ctlq_clean_sq() is reached, the kernel has already disabled bottom-half processing and holds the _xmit_ETHER spinlock (acquired in __dev_open()), making it an atomic context where sleeping (mutex) locks are forbidden. The fix converts cq_lock from a mutex to a spinlock and changes DMA memory allocation to use contiguous physical memory to avoid vunmap() calls that are unsafe under a spinlock (Red Hat Bugzilla).

Exploitation of this vulnerability can cause system instability and denial of service on affected Linux systems. When triggered, the kernel emits a BUG: sleeping function called from invalid context warning, which can disrupt network interface initialization and potentially destabilize the kernel depending on configuration. There is no confidentiality or integrity impact; the vulnerability is limited to availability, specifically affecting systems using Intel idpf-based network adapters with the VIRTCHNL2_CAP_MACFILTER capability enabled (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2025-38392. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), reflecting very low probability of exploitation in the near term. Triggering the bug requires local access to a system running an affected kernel version with an Intel idpf adapter and VIRTCHNL2_CAP_MACFILTER enabled (Red Hat Advisory).

The primary remediation is to update to a patched Linux kernel version: 6.12.37 or later (for the 6.7–6.12 branch) or 6.15.6 or later (for the 6.13–6.15 branch). Red Hat has issued patches via RHSA-2025:15429 (RHEL 9), RHSA-2025:15782 (RHEL 10), RHSA-2025:15785 and RHSA-2025:15786 (RHEL 8), and RHSA-2025:17958 (RHEL 9.4 EUS). Ubuntu has addressed the issue in USN-7833-1 through USN-7833-4. As a temporary workaround, disabling VIRTCHNL2_CAP_MACFILTER on affected systems can prevent the bug from triggering (Red Hat Bugzilla, Red Hat RHSA-2025:15429).