CVE-2025-39832 net/mlx5: Fix lockdep assertion on sync reset unload event
A race condition in the mlx5 driver causes a lockdep assertion failure during sync reset, potentially leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39832?
CVE-2025-39832 is a medium-severity vulnerability in Linux kernel, published on 16 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix lockdep assertion on sync reset unload event
Fix lockdep assertion triggered during sync reset unload event. When the sync reset flow is initiated using the devlink reload fw_activate option, the PF already holds the devlink lock while handling unload event. In this case, delegate sync reset unload event handling back to the devlink callback process to avoid double-locking and resolve the lockdep warning.
Kernel log: WARNING: CPU: 9 PID: 1578 at devl_assert_locked+0x31/0x40 [...] Call Trace: <TASK> mlx5_unload_one_devl_locked+0x2c/0xc0 [mlx5_core] mlx5_sync_reset_unload_event+0xaf/0x2f0 [mlx5_core] process_one_work+0x222/0x640 worker_thread+0x199/0x350 kthread+0x10b/0x230 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x8e/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
Weakness: CWE-667
Which versions are affected by CVE-2025-39832?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-39832?
Apply the vendor's patch.
Is CVE-2025-39832 being exploited?
There is no known exploitation of CVE-2025-39832 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-67407, BELL-CVE-2025-39832, DEBIAN-CVE-2025-39832, GHSA-qcgc-5p4x-hxc8, ROOT-OS-DEBIAN-13-CVE-2025-39832, ROOT-OS-UBUNTU-2404-CVE-2025-39832 and 1 more.