{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2025-38388 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-38388 is a medium-severity vulnerability in Linux kernel, published on 25 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-38388 and fix it if it is affected.\n\nWhat it is: CVE-2025-38388 is a medium-severity vulnerability in Linux kernel, published on 25 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-38388 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-38388/ (Markdown: https://insights.sbomify.com/CVE-2025-38388/index.md)","id":"CVE-2025-38388","markdown":"https://insights.sbomify.com/CVE-2025-38388/index.md","name":"CVE-2025-38388","record":{"aliases":["BELL-CVE-2025-38388","DEBIAN-CVE-2025-38388","GHSA-58vg-w4wx-wp6p","ROOT-OS-UBUNTU-2404-CVE-2025-38388","UBUNTU-CVE-2025-38388"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A race condition in the Linux kernel ARM FFA firmware driver causes kernel warnings and potential instability by sleeping in atomic context.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-667","name":"Improper Locking"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context\n\nThe current use of a mutex to protect the notifier hashtable accesses\ncan lead to issues in the atomic context. It results in the below\nkernel warnings:\n\n  |  BUG: sleeping function called from invalid context at kernel/locking/mutex.c:258\n  |  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0\n  |  preempt_count: 1, expected: 0\n  |  RCU nest depth: 0, expected: 0\n  |  CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.14.0 #4\n  |  Workqueue: ffa_pcpu_irq_notification notif_pcpu_irq_work_fn\n  |  Call trace:\n  |   show_stack+0x18/0x24 (C)\n  |   dump_stack_lvl+0x78/0x90\n  |   dump_stack+0x18/0x24\n  |   __might_resched+0x114/0x170\n  |   __might_sleep+0x48/0x98\n  |   mutex_lock+0x24/0x80\n  |   handle_notif_callbacks+0x54/0xe0\n  |   notif_get_and_handle+0x40/0x88\n  |   generic_exec_single+0x80/0xc0\n  |   smp_call_function_single+0xfc/0x1a0\n  |   notif_pcpu_irq_work_fn+0x2c/0x38\n  |   process_one_work+0x14c/0x2b4\n  |   worker_thread+0x2e4/0x3e0\n  |   kthread+0x13c/0x210\n  |   ret_from_fork+0x10/0x20\n\nTo address this, replace the mutex with an rwlock to protect the notifier\nhashtable accesses. This ensures that read-side locking does not sleep and\nmultiple readers can acquire the lock concurrently, avoiding unnecessary\ncontention and potential deadlocks. Writer access remains exclusive,\npreserving correctness.\n\nThis change resolves warnings from lockdep about potential sleep in\natomic context.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context","id":"CVE-2025-38388","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"race_condition","year":"2025"},"n_packages":0,"n_references":3,"next":{"headline":"drm/i915/gt: Fix timeline left held on VMA alloc error","id":"CVE-2025-38389"},"packages":[],"prev":{"headline":"RDMA/mlx5: Initialize obj_event-\u003eobj_sub_list before xa_insert","id":"CVE-2025-38387"},"products":["Linux"],"published":"2025-07-25","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A race condition in the Linux kernel ARM FFA firmware driver causes kernel warnings and potential instability by sleeping in atomic context.","url":"https://insights.sbomify.com/CVE-2025-38388/"}