In the Linux kernel, the following vulnerability has been resolved:
RDMA/cma: Fix hang when cmaneteventcallback fails to queue_work
The cited commit fixed a crash when cmaneteventcallback was called for a cma_id while work on that id from a previous call had not yet started. The work item was re-initialized in the second call, which corrupted the work item currently in the work queue.
However, it left a problem when queuework fails (because the item is still pending in the work queue from a previous call). In this case, cmaid_put (which is called in the work handler) is therefore not called. This results in a userspace process hang (zombie process).
Fix this by calling cmaidput() if queue_work fails.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38151.json",
"cna_assigner": "Linux"
}[
{
"target": {
"file": "drivers/infiniband/core/cma.c"
},
"id": "CVE-2025-38151-03bafc56",
"digest": {
"line_hashes": [
"261594715480134588178502596627888497882",
"6312824675202296143799105812922184572",
"9698676555243576591325327049385890811",
"68396748005171805968273876360094898756"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92a251c3df8ea1991cd9fe00f1ab0cfce18d7711",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"function": "cma_netevent_callback",
"file": "drivers/infiniband/core/cma.c"
},
"id": "CVE-2025-38151-cbc919b0",
"digest": {
"function_hash": "38521622100504167320143063381709155129",
"length": 1046.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92a251c3df8ea1991cd9fe00f1ab0cfce18d7711",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38151.json"