CVE-2025-38151
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work
The cited commit fixed a crash when cma_netevent_callback was called for a cma_id while work on that id from a previous call had not yet started. The work item was re-initialized in the second call, which corrupted the work item currently in the work queue.
However, it left a problem when queue_work fails (because the item is still pending in the work queue from a previous call). In this case, cma_id_put (which is called in the work handler) is therefore not called. This results in a userspace process hang (zombie process).
Leer descripción completaMostrar menos
Fix this by calling cma_id_put() if queue_work fails.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.18%
- Percentil entre todas las CVEs puntuadas: 7
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- NVD-CWE-noinfo
Referencias
- https://git.kernel.org/stable/c/02e45168e0fd6fdc6f8f7c42c4b500857aa5efb0
- https://git.kernel.org/stable/c/1ac40736c8c4255d8417b937c9715b193f4a87b3
- https://git.kernel.org/stable/c/8b05aa3692e45b8249379dc52b14acc6a104d2e5
- https://git.kernel.org/stable/c/92a251c3df8ea1991cd9fe00f1ab0cfce18d7711
- https://git.kernel.org/stable/c/ac7897c0124066b9705ffca252a3662d54fc0c9b
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-38151",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "51003b2c872c63d28bcf5fbcc52cf7b05615f7b7",
"lessThan": "1ac40736c8c4255d8417b937c9715b193f4a87b3",
"versionType": "git"
},
{
"status": "affected",
"version": "c2b169fc7a12665d8a675c1ff14bca1b9c63fb9a",
"lessThan": "ac7897c0124066b9705ffca252a3662d54fc0c9b",
"versionType": "git"
},
{
"status": "affected",
"version": "d23fd7a539ac078df119707110686a5b226ee3bb",
"lessThan": "02e45168e0fd6fdc6f8f7c42c4b500857aa5efb0",
"versionType": "git"
},
{
"status": "affected",
"version": "45f5dcdd049719fb999393b30679605f16ebce14",
"lessThan": "8b05aa3692e45b8249379dc52b14acc6a104d2e5",
"versionType": "git"
},
{
"status": "affected",
"version": "45f5dcdd049719fb999393b30679605f16ebce14",
"lessThan": "92a251c3df8ea1991cd9fe00f1ab0cfce18d7711",
"versionType": "git"
},
{
"status": "affected",
"version": "b172a4a0de254f1fcce7591833a9a63547c2f447",
"versionType": "git"
},
{
"status": "affected",
"version": "6.1.135",
"lessThan": "6.1.142",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.88",
"lessThan": "6.6.94",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.25",
"lessThan": "6.12.34",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.14.4",
"lessThan": "6.15",
"versionType": "semver"
}
],
"programFiles": [
"drivers/infiniband/core/cma.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.142",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.94",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.34",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.15.3",
"versionType": "semver",
"lessThanOrEqual": "6.15.*"
},
{
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/infiniband/core/cma.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-07-03T09:15:30.093",
"references": [
{
"url": "https://git.kernel.org/stable/c/02e45168e0fd6fdc6f8f7c42c4b500857aa5efb0",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1ac40736c8c4255d8417b937c9715b193f4a87b3",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8b05aa3692e45b8249379dc52b14acc6a104d2e5",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/92a251c3df8ea1991cd9fe00f1ab0cfce18d7711",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ac7897c0124066b9705ffca252a3662d54fc0c9b",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Fix hang when cma_netevent_callback fails to queue_work\n\nThe cited commit fixed a crash when cma_netevent_callback was called for\na cma_id while work on that id from a previous call had not yet started.\nThe work item was re-initialized in the second call, which corrupted the\nwork item currently in the work queue.\n\nHowever, it left a problem when queue_work fails (because the item is\nstill pending in the work queue from a previous call). In this case,\ncma_id_put (which is called in the work handler) is therefore not\ncalled. This results in a userspace process hang (zombie process).\n\nFix this by calling cma_id_put() if queue_work fails."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/cma: Se corrige el bloqueo cuando cma_netevent_callback no puede ejecutar queue_work La confirmación citada corrigió un bloqueo cuando se llamaba a cma_netevent_callback para un cma_id mientras que el trabajo en ese id de una llamada anterior aún no había comenzado. El elemento de trabajo se reinicializó en la segunda llamada, lo que corrompió el elemento de trabajo que se encontraba actualmente en la cola de trabajos. Sin embargo, dejó un problema cuando queue_work falla (porque el elemento sigue pendiente en la cola de trabajos de una llamada anterior). En este caso, por lo tanto, cma_id_put (que se llama en el controlador de trabajos) no se llama. Esto da como resultado un bloqueo del proceso del espacio de usuario (proceso zombi). Arregle esto llamando a cma_id_put() si queue_work falla."
}
],
"lastModified": "2026-06-17T09:16:09.450",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21A46709-FEB0-4AB6-A074-3855BFB48643",
"versionEndExcluding": "6.1.142",
"versionStartIncluding": "6.1.135"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A73BCEAB-712E-42CC-98FC-D48FDD0C18D3",
"versionEndExcluding": "6.6.94",
"versionStartIncluding": "6.6.88"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C717F3B5-1603-4EE7-BB0B-B9D258300722",
"versionEndExcluding": "6.12.34",
"versionStartIncluding": "6.12.25"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "786E593C-5048-4AE0-9421-71BE44AB6058",
"versionEndExcluding": "6.15",
"versionStartIncluding": "6.14.4"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "94EFC2F0-D796-44B3-BB7E-D7800275E9AD",
"versionEndExcluding": "6.15.3",
"versionStartIncluding": "6.15.1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A1ECC65A-EE37-4479-8E99-4BB68A22A31F"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2D240580-3048-49B2-9E27-F115A9DF8224"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "90320558-E553-4EF5-8A0B-0F5D20113BD2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C300BA32-5854-4B59-A00A-18A402F291D0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}