Linux kernel mlx5_ib: implicit ODP page-fault handler touches the MR xarray without the required lock

CVSS 5.5CVE-2025-38372Firmware, BMC & network fabriccurated

Impact

The implicit on-demand-paging path (pagefault_mr) used __xa_store() and __xa_erase() without holding the xarray lock, which is unsafe RCU usage and trips a lockdep warning on a debug kernel. The exposure is a concurrency bug in the per-MR child tracking of implicit ODP, which is exactly the feature RDMA clusters enable so that registered regions can be paged rather than pinned. The record documents a lockdep splat, not an observed corruption or cross-tenant read, and NVD scores it local availability only - treat it as a stability fix for ODP-enabled fabrics rather than an exploitable primitive. This is a distinct flaw from the DM-MR deregistration bug in the same driver.

Who can reach it

Local user with an ib_uverbs handle that can register implicit ODP memory regions, i.e. a tenant with RDMA device access on the node. No authentication beyond that device handle; no remote path.

What to do

Take the stable fix (the three linked commits replace the unlocked helpers with xa_store()/xa_erase()) via a distribution kernel update and reboot the node. No configuration mitigation other than not enabling implicit ODP for tenant workloads. No standalone vendor advisory in the record.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-38372 https://git.kernel.org/stable/c/ebebffb47c78f63ba7e4fbde393e44af38b7625d https://git.kernel.org/stable/c/9d2ef890e49963b768d4fe5a33029aacd9f6b93f

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.