CVE-2025-37928
NoneCVSS
—
EPSS
0.7%
Published
May 20, 2025
CISA due date
—
Cloudanix analysis
A flaw in the Linux storage layer can cause the whole system to crash when certain debug options are turned on, and attackers are already using similar issues to break into machines.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
The vulnerability allows dm_bufio_lock to invoke spin_lock_bh under try_verify_in_tasklet, causing __scan and shrink_work to execute scheduling primitives from atomic context and trigger sleeping-function violations that panic the kernel.
Why it matters to the business
Linux systems using device-mapper may experience sudden kernel crashes and reboots during cache shrink operations, leading to unplanned downtime and potential data loss in storage-heavy workloads; the flaw has been publicly exploitable for over a year with active threat-actor interest.
How an attack unfolds
An attacker with the ability to trigger dm-bufio cache shrinking (via memory pressure or specific I/O patterns) on a kernel built with CONFIG_DEBUG_ATOMIC_SLEEP and try_verify_in_tasklet enabled forces the workqueue path through shrink_work while holding the BH-disabled lock, resulting in the atomic-context scheduling bug and kernel panic; observed in campaigns targeting Linux privilege-escalation chains alongside related kernel CVEs.
How to fix it
Upgrade the Linux kernel to commit a99f5bf4f7197009859dbce14c12f8e2ce5a5a69 or later stable releases that remove the atomic-context scheduling call from shrink_work; apply vendor backports immediately given the public exploit availability and 526-day exposure window.
How to confirm the fix worked
Confirm the presence of the fix commit in the running kernel source; reproduce the original panic scenario with CONFIG_DEBUG_ATOMIC_SLEEP and try_verify_in_tasklet enabled and verify no BUG is triggered; inspect dm-bufio.c around line 2421 for the corrected locking sequence.
Typical attack path
- Identify or create conditions that cause dm-bufio cache pressure
- Ensure target kernel has debug atomic-sleep checks and tasklet verification enabled
- Trigger shrink_work via memory reclaim or dm device activity
- Force execution of __scan while spin_lock_bh is held
- Induce sleeping function call to produce kernel BUG and crash
How to detect it
Search kernel logs and dmesg for the exact BUG message 'sleeping function called from invalid context at drivers/md/dm-bufio.c:2421', 'in_atomic(): 1', 'shrink_work+0x', and the android_rvh_schedule_bug trace; correlate with kworker processes named dm_bufio_cache and any preceding memory-pressure events.
- BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:2421
- shrink_work+0x180/0x248
- Workqueue: dm_bufio_cache shrink_work
- android_rvh_schedule_bug+0x0/0x8
- Preemption disabled at: shrink_work+0x21c/0x248
What your security team should do
- Prioritize kernel upgrades to the listed fixed commit across all dm-bufio-using systems within 48 hours
- Disable try_verify_in_tasklet or CONFIG_DEBUG_ATOMIC_SLEEP in production kernels until patched
- Monitor for related Linux kernel privilege-escalation campaigns and apply coordinated patches for sibling CVEs
- Add the reported BUG string and shrink_work call trace to SIEM detection rules
The record
In the Linux kernel, the following vulnerability has been resolved: dm-bufio: don't schedule in atomic context A BUG was reported as below when CONFIG_DEBUG_ATOMIC_SLEEP and try_verify_in_tasklet are enabled. [ 129.444685][ T934] BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:2421 [ 129.444723][ T934] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 934, name: kworker/1:4 [ 129.444740][ T934] preempt_count: 201, expected: 0 [ 129.444756][ T934] RCU nest depth: 0, expected: 0 [ 129.444781][ T934] Preemption disabled at: [ 129.444789][ T934] [<ffffffd816231900>] shrink_work+0x21c/0x248 [ 129.445167][ T934] kernel BUG at kernel/sched/walt/walt_debug.c:16! [ 129.445183][ T934] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP [ 129.445204][ T934] Skip md ftrace buffer dump for: 0x1609e0 [ 129.447348][ T934] CPU: 1 PID: 934 Comm: kworker/1:4 Tainted: G W OE 6.6.56-android15-8-o-g6f82312b30b9-debug #1 1400000003000000474e5500b3187743670464e8 [ 129.447362][ T934] Hardware name: Qualcomm Technologies, Inc. Parrot QRD, Alpha-M (DT) [ 129.447373][ T934] Workqueue: dm_bufio_cache shrink_work [ 129.447394][ T934] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 129.447406][ T934] pc : android_rvh_schedule_bug+0x0/0x8 [sched_walt_debug] [ 129.447435][ T934] lr : __traceiter_android_rvh_schedule_bug+0x44/0x6c [ 129.447451][ T934] sp : ffffffc0843dbc90 [ 129.447459][ T934] x29: ffffffc0843dbc90 x28: ffffffffffffffff x27: 0000000000000c8b [ 129.447479][ T934] x26: 0000000000000040 x25: ffffff804b3d6260 x24: ffffffd816232b68 [ 129.447497][ T934] x23: ffffff805171c5b4 x22: 0000000000000000 x21: ffffffd816231900 [ 129.447517][ T934] x20: ffffff80306ba898 x19: 0000000000000000 x18: ffffffc084159030 [ 129.447535][ T934] x17: 00000000d2b5dd1f x16: 00000000d2b5dd1f x15: ffffffd816720358 [ 129.447554][ T934] x14: 0000000000000004 x13: ffffff89ef978000 x12: 0000000000000003 [ 129.447572][ T934] x11: ffffffd817a823c4 x10: 0000000000000202 x9 : 7e779c5735de9400 [ 129.447591][ T934] x8 : ffffffd81560d004 x7 : 205b5d3938373434 x6 : ffffffd8167397c8 [ 129.447610][ T934] x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffffffc0843db9e0 [ 129.447629][ T934] x2 : 0000000000002f15 x1 : 0000000000000000 x0 : 0000000000000000 [ 129.447647][ T934] Call trace: [ 129.447655][ T934] android_rvh_schedule_bug+0x0/0x8 [sched_walt_debug 1400000003000000474e550080cce8a8a78606b6] [ 129.447681][ T934] __might_resched+0x190/0x1a8 [ 129.447694][ T934] shrink_work+0x180/0x248 [ 129.447706][ T934] process_one_work+0x260/0x624 [ 129.447718][ T934] worker_thread+0x28c/0x454 [ 129.447729][ T934] kthread+0x118/0x158 [ 129.447742][ T934] ret_from_fork+0x10/0x20 [ 129.447761][ T934] Code: ???????? ???????? ???????? d2b5dd1f (d4210000) [ 129.447772][ T934] ---[ end trace 0000000000000000 ]--- dm_bufio_lock will call spin_lock_bh when try_verify_in_tasklet is enabled, and __scan will be called in atomic context.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux | 0 | No fix |
| Debian:11 | linux-6.1 | 0 | 6.1.140-1~deb11u1 |
| Debian:12 | linux | 0 | 6.1.140-1 |
| Debian:13 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.12.29-1 |
| Debian:14 | linux | 0 | 6.12.29-1 |
| Linux | Kernel | 4.9.0 | 6.1.138 |
| Mageia:9 | dwarves | 0 | 1.30-1.mga9 |
| Mageia:9 | kernel | 0 | 6.6.93-1.mga9 |
| Mageia:9 | kernel-firmware | 0 | 20250509-1.mga9 |
| Mageia:9 | kernel-firmware-nonfree | 0 | 20250509-1.mga9.nonfree |
| Mageia:9 | kernel-linus | 0 | 6.6.93-1.mga9 |
| Mageia:9 | kmod-virtualbox | 0 | 7.1.8-3.mga9 |
| Mageia:9 | kmod-xtables-addons | 0 | 3.24-80.mga9 |
| Mageia:9 | libtraceevent | 0 | 1.8.4-1.mga9 |
| Mageia:9 | libtracefs | 0 | 1.8.2-1.mga9 |
| Mageia:9 | radeon-firmware | 0 | 20250509-1.mga9.nonfree |
| Mageia:9 | wireless-regdb | 0 | 20250220-1.mga9 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.53.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.53.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_11 | 0 | 1-150600.1.3.2 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_12 | 0 | 1-150600.13.3.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.53.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.53.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.53.1.150600.12.24.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.53.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.53.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco | 0 | 6.4.0-15061.28.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco_debug | 0 | 6.4.0-15061.28.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-source-coco | 0 | 6.4.0-15061.28.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-syms-coco | 0 | 6.4.0-15061.28.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.53.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.53.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.53.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.53.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.53.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.40.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.40.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.40.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.53.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.39.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.39.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.39.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.53.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.53.1 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.40.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.53.1 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.53.1 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.53.1.150600.12.24.1 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.53.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.53.1 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.53.1 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.53.1 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.53.1 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.40.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.53.1 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.40.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.53.1 |
Related vulnerabilities
- CVE-2025-39885 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive… Also affects linux
- CVE-2025-39883 In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure… Also affects linux
- CVE-2025-39876 In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix… Also affects linux
- CVE-2025-39869 In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma… Also affects linux
- CVE-2025-39873 In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can… Also affects linux
- CVE-2025-39863 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix… Also affects linux
- CVE-2025-39865 In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer… Also affects linux
- CVE-2025-39866 In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix… Also affects linux