5.5

CVE-2025-38551

virtio-net: fix recursived rtnl_lock() during probe()

In the Linux kernel, the following vulnerability has been resolved:

virtio-net: fix recursived rtnl_lock() during probe()

The deadlock appears in a stack trace like:

  virtnet_probe()
    rtnl_lock()
    virtio_config_changed_work()
      netdev_notify_peers()
        rtnl_lock()

It happens if the VMM sends a VIRTIO_NET_S_ANNOUNCE request while the
virtio-net driver is still probing.

The config_work in probe() will get scheduled until virtnet_open() enables
the config change notification via virtio_config_driver_enable().
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 6.11.2 < 6.12.40
Linux ≫ Linux Kernel Version >= 6.13 < 6.15.8
Linux ≫ Linux Kernel Version 6.16 Update rc1
Linux ≫ Linux Kernel Version 6.16 Update rc2
Linux ≫ Linux Kernel Version 6.16 Update rc3
Linux ≫ Linux Kernel Version 6.16 Update rc4
Linux ≫ Linux Kernel Version 6.16 Update rc5
Linux ≫ Linux Kernel Version 6.16 Update rc6
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.11% 0.017
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-667 Improper Locking

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

https://git.kernel.org/stable/c/4e7c46362550b229354aeb52038f414e231b0037
Patch
https://git.kernel.org/stable/c/3859f137b3c1fa1f0031d54263234566bdcdd7aa
Patch
https://git.kernel.org/stable/c/be5dcaed694e4255dc02dd0acfe036708c535def
Patch