CVE-2025-38151

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38151", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.989Z", "datePublished": "2025-07-03T08:35:55.879Z", "dateUpdated": "2026-05-23T15:59:05.473Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T15:59:05.473Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Fix hang when cma_netevent_callback fails to queue_work\n\nThe cited commit fixed a crash when cma_netevent_callback was called for\na cma_id while work on that id from a previous call had not yet started.\nThe work item was re-initialized in the second call, which corrupted the\nwork item currently in the work queue.\n\nHowever, it left a problem when queue_work fails (because the item is\nstill pending in the work queue from a previous call). In this case,\ncma_id_put (which is called in the work handler) is therefore not\ncalled. This results in a userspace process hang (zombie process).\n\nFix this by calling cma_id_put() if queue_work fails."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/core/cma.c"], "versions": [{"version": "51003b2c872c63d28bcf5fbcc52cf7b05615f7b7", "lessThan": "1ac40736c8c4255d8417b937c9715b193f4a87b3", "status": "affected", "versionType": "git"}, {"version": "c2b169fc7a12665d8a675c1ff14bca1b9c63fb9a", "lessThan": "ac7897c0124066b9705ffca252a3662d54fc0c9b", "status": "affected", "versionType": "git"}, {"version": "d23fd7a539ac078df119707110686a5b226ee3bb", "lessThan": "02e45168e0fd6fdc6f8f7c42c4b500857aa5efb0", "status": "affected", "versionType": "git"}, {"version": "45f5dcdd049719fb999393b30679605f16ebce14", "lessThan": "8b05aa3692e45b8249379dc52b14acc6a104d2e5", "status": "affected", "versionType": "git"}, {"version": "45f5dcdd049719fb999393b30679605f16ebce14", "lessThan": "92a251c3df8ea1991cd9fe00f1ab0cfce18d7711", "status": "affected", "versionType": "git"}, {"version": "b172a4a0de254f1fcce7591833a9a63547c2f447", "status": "affected", "versionType": "git"}, {"version": "6.1.135", "lessThan": "6.1.142", "status": "affected", "versionType": "semver"}, {"version": "6.6.88", "lessThan": "6.6.94", "status": "affected", "versionType": "semver"}, {"version": "6.12.25", "lessThan": "6.12.34", "status": "affected", "versionType": "semver"}, {"version": "6.14.4", "lessThan": "6.15", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/core/cma.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.142", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.94", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.34", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.135", "versionEndExcluding": "6.1.142"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.88", "versionEndExcluding": "6.6.94"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.25", "versionEndExcluding": "6.12.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.15.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1ac40736c8c4255d8417b937c9715b193f4a87b3"}, {"url": "https://git.kernel.org/stable/c/ac7897c0124066b9705ffca252a3662d54fc0c9b"}, {"url": "https://git.kernel.org/stable/c/02e45168e0fd6fdc6f8f7c42c4b500857aa5efb0"}, {"url": "https://git.kernel.org/stable/c/8b05aa3692e45b8249379dc52b14acc6a104d2e5"}, {"url": "https://git.kernel.org/stable/c/92a251c3df8ea1991cd9fe00f1ab0cfce18d7711"}], "title": "RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:34:41.520Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/core/cma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1ac40736c8c4255d8417b937c9715b193f4a87b3", "status": "affected", "version": "51003b2c872c63d28bcf5fbcc52cf7b05615f7b7", "versionType": "git"}, {"lessThan": "ac7897c0124066b9705ffca252a3662d54fc0c9b", "status": "affected", "version": "c2b169fc7a12665d8a675c1ff14bca1b9c63fb9a", "versionType": "git"}, {"lessThan": "02e45168e0fd6fdc6f8f7c42c4b500857aa5efb0", "status": "affected", "version": "d23fd7a539ac078df119707110686a5b226ee3bb", "versionType": "git"}, {"lessThan": "8b05aa3692e45b8249379dc52b14acc6a104d2e5", "status": "affected", "version": "45f5dcdd049719fb999393b30679605f16ebce14", "versionType": "git"}, {"lessThan": "92a251c3df8ea1991cd9fe00f1ab0cfce18d7711", "status": "affected", "version": "45f5dcdd049719fb999393b30679605f16ebce14", "versionType": "git"}, {"status": "affected", "version": "b172a4a0de254f1fcce7591833a9a63547c2f447", "versionType": "git"}, {"lessThan": "6.1.142", "status": "affected", "version": "6.1.135", "versionType": "semver"}, {"lessThan": "6.6.94", "status": "affected", "version": "6.6.88", "versionType": "semver"}, {"lessThan": "6.12.34", "status": "affected", "version": "6.12.25", "versionType": "semver"}, {"lessThan": "6.15", "status": "affected", "version": "6.14.4", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/core/cma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.142", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.94", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.34", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "21A46709-FEB0-4AB6-A074-3855BFB48643", "versionEndExcluding": "6.1.142", "versionStartIncluding": "6.1.135", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A73BCEAB-712E-42CC-98FC-D48FDD0C18D3", "versionEndExcluding": "6.6.94", "versionStartIncluding": "6.6.88", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C717F3B5-1603-4EE7-BB0B-B9D258300722", "versionEndExcluding": "6.12.34", "versionStartIncluding": "6.12.25", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "786E593C-5048-4AE0-9421-71BE44AB6058", "versionEndExcluding": "6.15", "versionStartIncluding": "6.14.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "94EFC2F0-D796-44B3-BB7E-D7800275E9AD", "versionEndExcluding": "6.15.3", "versionStartIncluding": "6.15.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*", "matchCriteriaId": "A1ECC65A-EE37-4479-8E99-4BB68A22A31F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*", "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*", "matchCriteriaId": "2D240580-3048-49B2-9E27-F115A9DF8224", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*", "matchCriteriaId": "90320558-E553-4EF5-8A0B-0F5D20113BD2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*", "matchCriteriaId": "C300BA32-5854-4B59-A00A-18A402F291D0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Fix hang when cma_netevent_callback fails to queue_work\n\nThe cited commit fixed a crash when cma_netevent_callback was called for\na cma_id while work on that id from a previous call had not yet started.\nThe work item was re-initialized in the second call, which corrupted the\nwork item currently in the work queue.\n\nHowever, it left a problem when queue_work fails (because the item is\nstill pending in the work queue from a previous call). In this case,\ncma_id_put (which is called in the work handler) is therefore not\ncalled. This results in a userspace process hang (zombie process).\n\nFix this by calling cma_id_put() if queue_work fails."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/cma: Se corrige el bloqueo cuando cma_netevent_callback no puede ejecutar queue_work La confirmaci\u00f3n citada corrigi\u00f3 un bloqueo cuando se llamaba a cma_netevent_callback para un cma_id mientras que el trabajo en ese id de una llamada anterior a\u00fan no hab\u00eda comenzado. El elemento de trabajo se reinicializ\u00f3 en la segunda llamada, lo que corrompi\u00f3 el elemento de trabajo que se encontraba actualmente en la cola de trabajos. Sin embargo, dej\u00f3 un problema cuando queue_work falla (porque el elemento sigue pendiente en la cola de trabajos de una llamada anterior). En este caso, por lo tanto, cma_id_put (que se llama en el controlador de trabajos) no se llama. Esto da como resultado un bloqueo del proceso del espacio de usuario (proceso zombi). Arregle esto llamando a cma_id_put() si queue_work falla."}], "id": "CVE-2025-38151", "lastModified": "2026-06-17T09:16:09.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-07-03T09:15:30.093", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/02e45168e0fd6fdc6f8f7c42c4b500857aa5efb0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1ac40736c8c4255d8417b937c9715b193f4a87b3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8b05aa3692e45b8249379dc52b14acc6a104d2e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/92a251c3df8ea1991cd9fe00f1ab0cfce18d7711"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ac7897c0124066b9705ffca252a3662d54fc0c9b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work", "id": "2376049", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376049"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nRDMA/cma: Fix hang when cma_netevent_callback fails to queue_work\nThe cited commit fixed a crash when cma_netevent_callback was called for\na cma_id while work on that id from a previous call had not yet started.\nThe work item was re-initialized in the second call, which corrupted the\nwork item currently in the work queue.\nHowever, it left a problem when queue_work fails (because the item is\nstill pending in the work queue from a previous call). In this case,\ncma_id_put (which is called in the work handler) is therefore not\ncalled. This results in a userspace process hang (zombie process).\nFix this by calling cma_id_put() if queue_work fails."], "name": "CVE-2025-38151", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38151\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38151\nhttps://lore.kernel.org/linux-cve-announce/2025070336-CVE-2025-38151-6483@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-06T22:16:20.876431+00:00", "updated": "2025-07-06T22:16:20.876476+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}