Linux kernel smartpqi: kexec reboot leaves the driver writing its log into live system memory

Impact

The smartpqi driver keyed its special-case behaviour off the reset_devices variable instead of is_kdump_kernel(), so an ordinary kexec reboot was treated like a crash-dump boot. Kernel-team testing found that this led to the driver log being written into system memory after the kexec, corrupting whatever now owns those pages, and also left parameters such as max_transfer_size clamped to kdump-sized values. On a GPU node this is a reliability and data-integrity problem on the boot storage path rather than an attack path: Smart Array / SmartRAID controllers back the local root and scratch volumes on many HPE and Microchip-based server platforms, and silent memory corruption after a kexec is exactly the class of fault that gets blamed on the GPU or the fabric for weeks. There is no indication in the record that a tenant or a remote attacker can trigger it; it requires the host to be kexec-rebooted.

Who can reach it

No network or tenant attack path in the record. Reached when the host itself is rebooted via kexec with a smartpqi controller present; the subsequent corruption is of host kernel memory. Local privileged action (kexec) is required, so this is a correctness/stability defect more than an exploitable flaw.

What to do

Pick up the fixed stable kernel and reboot the node; there is no module parameter or runtime toggle that changes the detection logic, so the fix lands only with a new kernel. Operators who use kexec for fast reboots on storage-attached GPU hosts should treat this as the reason to stop doing so until the kernel is updated. The upstream commits are linked from the NVD record; no vendor advisory with a single fixed version is present.

References

Related entries

• Linux kernel (drivers/iommu): With iommufd, a tenant can change a passthrough device's IOMMU domain while MSICVE-2025-38062 · Linux kernel (drivers/iommu)High
• Linux kernel sockmap: backlog worker uses a freed socket when a mapped socket is closed concurrentlyCVE-2025-38154 · Linux kernel BPF sockmap (sk_psock_backlog use-after-free on sk_socket)High
• Linux kernel (net/tls): A BPF verdict that grows the scatterlist (bpf_msg_push_data) combined with a cork_bytes settingCVE-2025-38166 · Linux kernel (net/tls)High
• Linux kernel nvme-tcp (admin tag set leak on secure-concatenation setup failure): After the change that reconnects theCVE-2025-38209 · Linux kernel nvme-tcp (admin tag set leak on secure-concatenation setup failure)High
• Linux kernel megaraid_sas: invalid NUMA node index causes an out-of-bounds access during driver probeCVE-2025-38239 · Linux kernel megaraid_sas driver (MSI-X vector allocation node index)High
• Linux kernel BPF verifier: stack pointer in precision backtracking triggers a backtracking bug warningCVE-2025-38279 · Linux kernel BPF verifier (stack pointer register in precision backtracking)High