{"answers":{"affected":"It affects 2 products.","exploited":"There is no known exploitation of CVE-2025-38387 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-38387 is a medium-severity vulnerability in Debian Debian Linux, published on 25 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-38387 and fix it if it is affected.\n\nWhat it is: CVE-2025-38387 is a medium-severity vulnerability in Debian Debian Linux, published on 25 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-38387 in the wild and no public exploit code.\n\nAffected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-38387/ (Markdown: https://insights.sbomify.com/CVE-2025-38387/index.md)","id":"CVE-2025-38387","markdown":"https://insights.sbomify.com/CVE-2025-38387/index.md","name":"CVE-2025-38387","record":{"aliases":["AZL-72403","BELL-CVE-2025-38387","DEBIAN-CVE-2025-38387","GHSA-v7p5-3x5h-w67g","ROOT-OS-DEBIAN-11-CVE-2025-38387","ROOT-OS-DEBIAN-12-CVE-2025-38387","ROOT-OS-UBUNTU-2204-CVE-2025-38387","ROOT-OS-UBUNTU-2404-CVE-2025-38387","UBUNTU-CVE-2025-38387"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A null pointer dereference in the Linux kernel RDMA mlx5 driver can cause a system crash, requiring a kernel patch to resolve.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"debian_linux","vendor":"debian"},{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-476","name":"NULL Pointer Dereference"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Initialize obj_event-\u003eobj_sub_list before xa_insert\n\nThe obj_event may be loaded immediately after inserted, then if the\nlist_head is not initialized then we may get a poisonous pointer.  This\nfixes the crash below:\n\n mlx5_core 0000:03:00.0: MLX5E: StrdRq(1) RqSz(8) StrdSz(2048) RxCqeCmprss(0 enhanced)\n mlx5_core.sf mlx5_core.sf.4: firmware version: 32.38.3056\n mlx5_core 0000:03:00.0 en3f0pf0sf2002: renamed from eth0\n mlx5_core.sf mlx5_core.sf.4: Rate limit: 127 rates are supported, range: 0Mbps to 195312Mbps\n IPv6: ADDRCONF(NETDEV_CHANGE): en3f0pf0sf2002: link becomes ready\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060\n Mem abort info:\n   ESR = 0x96000006\n   EC = 0x25: DABT (current EL), IL = 32 bits\n   SET = 0, FnV = 0\n   EA = 0, S1PTW = 0\n Data abort info:\n   ISV = 0, ISS = 0x00000006\n   CM = 0, WnR = 0\n user pgtable: 4k pages, 48-bit VAs, pgdp=00000007760fb000\n [0000000000000060] pgd=000000076f6d7003, p4d=000000076f6d7003, pud=0000000777841003, pmd=0000000000000000\n Internal error: Oops: 96000006 [#1] SMP\n Modules linked in: ipmb_host(OE) act_mirred(E) cls_flower(E) sch_ingress(E) mptcp_diag(E) udp_diag(E) raw_diag(E) unix_diag(E) tcp_diag(E) inet_diag(E) binfmt_misc(E) bonding(OE) rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) isofs(E) cdrom(E) mst_pciconf(OE) ib_umad(OE) mlx5_ib(OE) ipmb_dev_int(OE) mlx5_core(OE) kpatch_15237886(OEK) mlxdevm(OE) auxiliary(OE) ib_uverbs(OE) ib_core(OE) psample(E) mlxfw(OE) tls(E) sunrpc(E) vfat(E) fat(E) crct10dif_ce(E) ghash_ce(E) sha1_ce(E) sbsa_gwdt(E) virtio_console(E) ext4(E) mbcache(E) jbd2(E) xfs(E) libcrc32c(E) mmc_block(E) virtio_net(E) net_failover(E) failover(E) sha2_ce(E) sha256_arm64(E) nvme(OE) nvme_core(OE) gpio_mlxbf3(OE) mlx_compat(OE) mlxbf_pmc(OE) i2c_mlxbf(OE) sdhci_of_dwcmshc(OE) pinctrl_mlxbf3(OE) mlxbf_pka(OE) gpio_generic(E) i2c_core(E) mmc_core(E) mlxbf_gige(OE) vitesse(E) pwr_mlxbf(OE) mlxbf_tmfifo(OE) micrel(E) mlxbf_bootctl(OE) virtio_ring(E) virtio(E) ipmi_devintf(E) ipmi_msghandler(E)\n  [last unloaded: mst_pci]\n CPU: 11 PID: 20913 Comm: rte-worker-11 Kdump: loaded Tainted: G           OE K   5.10.134-13.1.an8.aarch64 #1\n Hardware name: https://www.mellanox.com BlueField-3 SmartNIC Main Card/BlueField-3 SmartNIC Main Card, BIOS 4.2.2.12968 Oct 26 2023\n pstate: a0400089 (NzCv daIf +PAN -UAO -TCO BTYPE=--)\n pc : dispatch_event_fd+0x68/0x300 [mlx5_ib]\n lr : devx_event_notifier+0xcc/0x228 [mlx5_ib]\n sp : ffff80001005bcf0\n x29: ffff80001005bcf0 x28: 0000000000000001\n x27: ffff244e0740a1d8 x26: ffff244e0740a1d0\n x25: ffffda56beff5ae0 x24: ffffda56bf911618\n x23: ffff244e0596a480 x22: ffff244e0596a480\n x21: ffff244d8312ad90 x20: ffff244e0596a480\n x19: fffffffffffffff0 x18: 0000000000000000\n x17: 0000000000000000 x16: ffffda56be66d620\n x15: 0000000000000000 x14: 0000000000000000\n x13: 0000000000000000 x12: 0000000000000000\n x11: 0000000000000040 x10: ffffda56bfcafb50\n x9 : ffffda5655c25f2c x8 : 0000000000000010\n x7 : 0000000000000000 x6 : ffff24545a2e24b8\n x5 : 0000000000000003 x4 : ffff80001005bd28\n x3 : 0000000000000000 x2 : 0000000000000000\n x1 : ffff244e0596a480 x0 : ffff244d8312ad90\n Call trace:\n  dispatch_event_fd+0x68/0x300 [mlx5_ib]\n  devx_event_notifier+0xcc/0x228 [mlx5_ib]\n  atomic_notifier_call_chain+0x58/0x80\n  mlx5_eq_async_int+0x148/0x2b0 [mlx5_core]\n  atomic_notifier_call_chain+0x58/0x80\n  irq_int_handler+0x20/0x30 [mlx5_core]\n  __handle_irq_event_percpu+0x60/0x220\n  handle_irq_event_percpu+0x3c/0x90\n  handle_irq_event+0x58/0x158\n  handle_fasteoi_irq+0xfc/0x188\n  generic_handle_irq+0x34/0x48\n  ...","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"RDMA/mlx5: Initialize obj_event-\u003eobj_sub_list before xa_insert","id":"CVE-2025-38387","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"debian:debian_linux","products":["debian:debian_linux","linux:linux_kernel"],"type":"null_dereference","year":"2025"},"n_packages":0,"n_references":8,"next":{"headline":"firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context","id":"CVE-2025-38388"},"packages":[],"prev":{"headline":"ACPICA: Refuse to evaluate a method if arguments are missing","id":"CVE-2025-38386"},"products":["Linux"],"published":"2025-07-25","related":[{"cvss_score":10,"headline":"ProFTPD Improper Access Control","id":"CVE-2015-3306","kev_date_added":"2026-10-08","published":"2015-05-18"},{"cvss_score":9.9,"headline":"RoundCube Webmail Deserialization of Untrusted Data","id":"CVE-2025-49113","kev_date_added":"2026-02-20","published":"2025-06-02"},{"cvss_score":9.8,"headline":"GNU InetUtils Argument Injection","id":"CVE-2026-24061","kev_date_added":"2026-01-26","published":"2026-01-21"},{"cvss_score":9.8,"headline":"Linux Kernel Improper Check for Unusual or Exceptional Conditions","id":"CVE-2025-39682","kev_date_added":"2026-09-18","published":"2025-09-05"},{"cvss_score":9.8,"headline":"Mozilla Firefox Use-After-Free","id":"CVE-2024-9680","kev_date_added":"2024-10-15","published":"2024-10-09"},{"cvss_score":9.8,"headline":"RARLAB UnRAR Directory Traversal","id":"CVE-2022-30333","kev_date_added":"2022-08-09","published":"2022-05-09"},{"cvss_score":9.8,"headline":"Roundcube Webmail SQL Injection","id":"CVE-2021-44026","kev_date_added":"2023-06-22","published":"2021-11-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A null pointer dereference in the Linux kernel RDMA mlx5 driver can cause a system crash, requiring a kernel patch to resolve.","url":"https://insights.sbomify.com/CVE-2025-38387/"}