{ "cveId": "CVE-2025-38311", "url": "https://patchblox.com/security/cve/CVE-2025-38311", "summary": "CVE-2025-38311 is fixed in 13 products on 1 platform, first by DEBIAN-CVE-2025-38311, released July 10, 2025. It is not reported as exploited. Patch Radar priority: High.", "title": "iavf: get rid of the crit lock", "description": "In the Linux kernel, the following vulnerability has been resolved: iavf: get rid of the crit lock Get rid of the crit lock. That frees us from the error prone logic of try_locks. Thanks to netdev_lock() by Jakub it is now easy, and in most cases we were protected by it already - replace crit lock by netdev lock when it was not the case. Lockdep reports that we should cancel the work under crit_lock [splat1], and that was the scheme we have mostly followed since [1] by Slawomir. But when that is done we still got into deadlocks [splat2]. So instead we should look at the bigger problem, namely \u0022weird locking/scheduling\u0022 of the iavf. The first step to fix that is to remove the crit lock. I will followup with a -next series that simplifies scheduling/tasks. Cancel the work without netdev lock (weird unlock\u002Block scheme), to fix the [splat2] (which would be totally ugly if we would kept the crit lock). Extend protected part of iavf_watchdog_task() to include scheduling more work. Note that the removed comment in iavf_reset_task() was misplaced, it belonged to inside of the removed if condition, so it\u0027s gone now. [splat1] - w/o this patch - The deadlock during VF removal: WARNING: possible circular locking dependency detected sh/3825 is trying to acquire lock: ((work_completion)(\u0026(\u0026adapter-\u003Ewatchdog_task)-\u003Ework)){\u002B.\u002B.}-{0:0}, at: start_flush_work\u002B0x1a1/0x470 but task is already holding lock: (\u0026adapter-\u003Ecrit_lock){\u002B.\u002B.}-{4:4}, at: iavf_remove\u002B0xd1/0x690 [iavf] which lock already depends on the new lock. [splat2] - when cancelling work under crit lock, w/o this series, \t see [2] for the band aid attempt WARNING: possible circular locking dependency detected sh/3550 is trying to acquire lock: ((wq_completion)iavf){\u002B.\u002B.}-{0:0}, at: touch_wq_lockdep_map\u002B0x26/0x90 but task is already holding lock: (\u0026dev-\u003Elock){\u002B.\u002B.}-{4:4}, at: iavf_remove\u002B0xa6/0x6e0 [iavf] which lock already depends on the new lock. [1] fc2e6b3b132a (\u0022iavf: Rework mutexes for better synchronisation\u0022) [2] https://github.com/pkitszel/linux/commit/52dddbfc2bb60294083f5711a158a", "published": "2025-07-10T08:15:30Z", "severity": "medium", "cvss": 7, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epss": 0.0011, "epssPercentile": 0.01269, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-38311", "fixes": [ { "platform": "linux", "product": "dtb-aarch64", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "OPENSUSE-SU-2025:20081-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20081-1", "released": "2025-11-25T07:35:00Z" }, { "platform": "linux", "product": "kernel-64kb", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "OPENSUSE-SU-2025:20081-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20081-1", "released": "2025-11-25T07:35:00Z" }, { "platform": "linux", "product": "kernel-64kb", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "SUSE-SU-2025:21139-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-21139-1", "released": "2025-11-25T07:34:57Z" }, { "platform": "linux", "product": "kernel-default", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "OPENSUSE-SU-2025:20081-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20081-1", "released": "2025-11-25T07:35:00Z" }, { "platform": "linux", "product": "kernel-default", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "SUSE-SU-2025:21139-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-21139-1", "released": "2025-11-25T07:34:57Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.6.1.160000.2.4", "fix": "OPENSUSE-SU-2025:20081-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20081-1", "released": "2025-11-25T07:35:00Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.6.1.160000.2.4", "fix": "SUSE-SU-2025:21139-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-21139-1", "released": "2025-11-25T07:34:57Z" }, { "platform": "linux", "product": "kernel-docs", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "OPENSUSE-SU-2025:20081-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20081-1", "released": "2025-11-25T07:35:00Z" }, { "platform": "linux", "product": "kernel-docs", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "SUSE-SU-2025:21139-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-21139-1", "released": "2025-11-25T07:34:57Z" }, { "platform": "linux", "product": "kernel-kvmsmall", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "OPENSUSE-SU-2025:20081-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20081-1", "released": "2025-11-25T07:35:00Z" }, { "platform": "linux", "product": "kernel-kvmsmall", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "SUSE-SU-2025:21139-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-21139-1", "released": "2025-11-25T07:34:57Z" }, { "platform": "linux", "product": "kernel-obs-build", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "OPENSUSE-SU-2025:20081-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20081-1", "released": "2025-11-25T07:35:00Z" }, { "platform": "linux", "product": "kernel-obs-qa", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "OPENSUSE-SU-2025:20081-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20081-1", "released": "2025-11-25T07:35:00Z" }, { "platform": "linux", "product": "kernel-obs-qa", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "SUSE-SU-2025:21139-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-21139-1", "released": "2025-11-25T07:34:57Z" }, { "platform": "linux", "product": "kernel-rt", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "OPENSUSE-SU-2025:20081-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20081-1", "released": "2025-11-25T07:35:00Z" }, { "platform": "linux", "product": "kernel-source", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "OPENSUSE-SU-2025:20081-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20081-1", "released": "2025-11-25T07:35:00Z" }, { "platform": "linux", "product": "kernel-source", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "SUSE-SU-2025:21139-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-21139-1", "released": "2025-11-25T07:34:57Z" }, { "platform": "linux", "product": "kernel-syms", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "OPENSUSE-SU-2025:20081-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20081-1", "released": "2025-11-25T07:35:00Z" }, { "platform": "linux", "product": "kernel-syms", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "SUSE-SU-2025:21139-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-21139-1", "released": "2025-11-25T07:34:57Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "OPENSUSE-SU-2025:20081-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20081-1", "released": "2025-11-25T07:35:00Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.6.1", "fix": "SUSE-SU-2025:21139-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-21139-1", "released": "2025-11-25T07:34:57Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "6.16.3-1", "fix": "DEBIAN-CVE-2025-38311", "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-38311", "released": "2025-07-10T08:15:30Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T13:31:49Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }