Linux kernel (drivers/infiniband/hw/mlx5): An event subscription is published to the lookup table before its list head

CVSS 5.5CVE-2025-38387Firmware, BMC & network fabriccurated

Impact

An event subscription is published to the lookup table before its list head is initialized, so a device event that arrives in the same instant follows a poison pointer and faults in kernel context. One tenant's event subscription can panic a shared mlx5 node.

Who can reach it

A container holding /dev/infiniband/uverbs* that uses the mlx5 DEVX interface to subscribe to device events, with hardware events arriving concurrently - the tenant controls both the subscription rate and much of the event traffic. DEVX normally requires CAP_NET_RAW, so this needs a privileged container or a tenant explicitly granted raw-network capability; plain verbs users cannot reach it.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: drop CAP_NET_RAW from tenant containers so the DEVX interface is unavailable, which closes this path entirely.

References

https://git.kernel.org/stable/c/716b555fc0580c2aa4c2c32ae4401c7e3ad9873e https://git.kernel.org/stable/c/972e968aac0dce8fe8faad54f6106de576695d8e https://nvd.nist.gov/vuln/detail/CVE-2025-38387

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.