CVE-2025-38720— net: hibmcge: fix rtnl deadlock issue
Affected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 3f5a61f6d504f55ed1a36cce044d5123d508721f< d85a6346fd6f595c4914205762d0cdf35c004a5e | affected |
3f5a61f6d504f55ed1a36cce044d5123d508721f< 1343a8994ca7dba78f5dd818e89d68331c21c35d | affected | ||
3f5a61f6d504f55ed1a36cce044d5123d508721f< c875503a9b9082928d7d3fc60b5400d16fbfae4e | affected | ||
6.14 | affected | ||
< 6.14 | unaffected | ||
6.15.11≤ 6.15.* | unaffected | ||
6.16.2≤ 6.16.* | unaffected | ||
6.17≤ * | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-38720
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net: hibmcge: fix rtnl deadlock issue
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: hibmcge: fix rtnl deadlock issue Currently, the hibmcge netdev acquires the rtnl_lock in pci_error_handlers.reset_prepare() and releases it in pci_error_handlers.reset_done(). However, in the PCI framework: pci_reset_bus - __pci_reset_slot - pci_slot_save_and_disable_locked - pci_dev_save_and_disable - err_handler->reset_prepare(dev); In pci_slot_save_and_disable_locked(): list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot!= slot) continue; pci_dev_save_and_disable(dev); if (dev->subordinate) pci_bus_save_and_disable_locked(dev->subordinate); } This will iterate through all devices under the current bus and execute err_handler->reset_prepare(), causing two devices of the hibmcge driver to sequentially request the rtnl_lock, leading to a deadlock. Since the driver now executes netif_device_detach() before the reset process, it will not concurrently with other netdev APIs, so there is no need to hold the rtnl_lock now. Therefore, this patch removes the rtnl_lock during the reset process and adjusts the position of HBG_NIC_STATE_RESETTING to ensure that multiple resets are not executed concurrently.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于hibmcge驱动在PCI错误处理中获取rtnl_lock不当，可能导致死锁。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-38720
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-38720
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-09-04 · 52 CVEs total
| CVE-2025-38693 | media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_t | |
| CVE-2025-38679 | media: venus: Fix OOB read due to missing payload bound check | |
| CVE-2025-38680 | media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() | |
| CVE-2025-38685 | fbdev: Fix vmalloc out-of-bounds write in fast_imageblit | |
| CVE-2025-38682 | i2c: core: Fix double-free of fwnode in i2c_unregister_device() | |
| CVE-2025-38683 | hv_netvsc: Fix panic during namespace deletion with VF | |
| CVE-2025-38684 | net/sched: ets: use old 'nbands' while purging unused classes | |
| CVE-2025-38681 | mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() | |
| CVE-2025-38692 | exfat: add cluster chain loop check for dir | |
| CVE-2025-38694 | media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() | |
| CVE-2025-38690 | drm/xe/migrate: prevent infinite recursion | |
| CVE-2025-38695 | scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure | |
| CVE-2025-38696 | MIPS: Don't crash in stack_top() for tasks without ABI or vDSO | |
| CVE-2025-38697 | jfs: upper bound check of tree index in dbAllocAG | |
| CVE-2025-38699 | scsi: bfa: Double-free fix | |
| CVE-2025-38698 | jfs: Regular file corruption check | |
| CVE-2025-38700 | scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated | |
| CVE-2025-38701 | ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr | |
| CVE-2025-38702 | fbdev: fix potential buffer overflow in do_register_framebuffer() | |
| CVE-2025-38703 | drm/xe: Make dma-fences compliant with the safe access rules |
Showing top 20 of 52 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43502
net/rds: handle zerocopy send cleanup before the message is - CVE-2026-43501
ipv6: rpl: reserve mac_len headroom when recompressed SRH gr - CVE-2026-43498
accel/ivpu: Disallow re-exporting imported GEM objects - CVE-2026-43499
rtmutex: Use waiter::task instead of current in remove_waite - CVE-2026-43497
fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-aft
Same vendor: Linux
- CVE-2026-43502
net/rds: handle zerocopy send cleanup before the message is - CVE-2026-43501
ipv6: rpl: reserve mac_len headroom when recompressed SRH gr - CVE-2026-43498
accel/ivpu: Disallow re-exporting imported GEM objects - CVE-2026-43499
rtmutex: Use waiter::task instead of current in remove_waite - CVE-2026-43497
fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-aft
V. Comments for CVE-2025-38720
No comments yet