CVE-2025-38005
NoneCVSS
—
EPSS
0.2%
Published
Jun 18, 2025
CISA due date
—
Cloudanix analysis
A missing safety lock in the Linux kernel code that moves data directly between memory and certain Texas Instruments chips can cause crashes or instability on affected devices until the system is updated.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Theoretical
- Impact
- Other
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Missing spinlock protection in udma_start.isra.0 within the TI K3 UDMA DMA engine driver allows concurrent access to channel state without synchronization, triggering lockdep warnings and potential race conditions during transmit completion checks.
Why it matters to the business
Embedded and ARM-based systems relying on affected Linux kernels for TI K3 hardware face increased risk of kernel warnings, DMA-related instability, or crashes under concurrent workloads, raising operational downtime and patch management costs across device fleets.
How an attack unfolds
A local attacker triggers repeated DMA transactions via user-space interfaces while the udma_check_tx_completion workqueue runs, exploiting the unprotected critical section to reach inconsistent driver state that may lead to kernel memory corruption or denial of service.
How to fix it
Apply the upstream fix by updating to a kernel containing commit 27e71fa08711e09d81e06a54007b362a5426fd22; rebuild and deploy the updated kernel image on all affected TI K3 devices, then reboot.
How to confirm the fix worked
Confirm the presence of the added spin_lock/spin_unlock calls around the critical section in drivers/dma/ti/k3-udma.c and verify that lockdep no longer emits the udma_start warning on boot or under DMA load.
Typical attack path
- Gain local unprivileged access on a vulnerable TI K3 platform
- Open or mmap DMA-related character devices or trigger workloads that enqueue DMA transfers
- Force concurrent execution of udma_start and completion paths to hit the unprotected window
- Observe or escalate from resulting kernel warnings or crashes
How to detect it
Search kernel logs and dmesg output for the exact warning string mentioning udma_start.isra.0 and virt-dma.h:169; inspect workqueue activity involving udma_check_tx_completion on affected hardware.
- udma_start.isra.0+0x34/0x238
- udma_check_tx_completion+0xd0/0xdc
- WARNING: CPU:.*PID:.*at drivers/dma/ti/../virt-dma.h:169
What your security team should do
- Inventory all devices running Linux kernels on TI K3 SoCs and schedule immediate kernel updates
- Test the fixed kernel in staging environments before wide deployment to avoid regressions
- Enable lockdep and kernel debugging on representative hardware to validate the absence of the warning
- Monitor vendor and stable kernel mailing lists for any follow-on fixes in the DMA subsystem
The record
In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma: Add missing locking Recent kernels complain about a missing lock in k3-udma.c when the lock validator is enabled: [ 4.128073] WARNING: CPU: 0 PID: 746 at drivers/dma/ti/../virt-dma.h:169 udma_start.isra.0+0x34/0x238 [ 4.137352] CPU: 0 UID: 0 PID: 746 Comm: kworker/0:3 Not tainted 6.12.9-arm64 #28 [ 4.144867] Hardware name: pp-v12 (DT) [ 4.148648] Workqueue: events udma_check_tx_completion [ 4.153841] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 4.160834] pc : udma_start.isra.0+0x34/0x238 [ 4.165227] lr : udma_start.isra.0+0x30/0x238 [ 4.169618] sp : ffffffc083cabcf0 [ 4.172963] x29: ffffffc083cabcf0 x28: 0000000000000000 x27: ffffff800001b005 [ 4.180167] x26: ffffffc0812f0000 x25: 0000000000000000 x24: 0000000000000000 [ 4.187370] x23: 0000000000000001 x22: 00000000e21eabe9 x21: ffffff8000fa0670 [ 4.194571] x20: ffffff8001b6bf00 x19: ffffff8000fa0430 x18: ffffffc083b95030 [ 4.201773] x17: 0000000000000000 x16: 00000000f0000000 x15: 0000000000000048 [ 4.208976] x14: 0000000000000048 x13: 0000000000000000 x12: 0000000000000001 [ 4.216179] x11: ffffffc08151a240 x10: 0000000000003ea1 x9 : ffffffc08046ab68 [ 4.223381] x8 : ffffffc083cabac0 x7 : ffffffc081df3718 x6 : 0000000000029fc8 [ 4.230583] x5 : ffffffc0817ee6d8 x4 : 0000000000000bc0 x3 : 0000000000000000 [ 4.237784] x2 : 0000000000000000 x1 : 00000000001fffff x0 : 0000000000000000 [ 4.244986] Call trace: [ 4.247463] udma_start.isra.0+0x34/0x238 [ 4.251509] udma_check_tx_completion+0xd0/0xdc [ 4.256076] process_one_work+0x244/0x3fc [ 4.260129] process_scheduled_works+0x6c/0x74 [ 4.264610] worker_thread+0x150/0x1dc [ 4.268398] kthread+0xd8/0xe8 [ 4.271492] ret_from_fork+0x10/0x20 [ 4.275107] irq event stamp: 220 [ 4.278363] hardirqs last enabled at (219): [<ffffffc080a27c7c>] _raw_spin_unlock_irq+0x38/0x50 [ 4.287183] hardirqs last disabled at (220): [<ffffffc080a1c154>] el1_dbg+0x24/0x50 [ 4.294879] softirqs last enabled at (182): [<ffffffc080037e68>] handle_softirqs+0x1c0/0x3cc [ 4.303437] softirqs last disabled at (177): [<ffffffc080010170>] __do_softirq+0x1c/0x28 [ 4.311559] ---[ end trace 0000000000000000 ]--- This commit adds the missing locking.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux | 0 | No fix |
| Debian:11 | linux-6.1 | 0 | 6.1.140-1~deb11u1 |
| Debian:12 | linux | 0 | 6.1.140-1 |
| Debian:13 | linux | 0 | 6.12.30-1 |
| Debian:14 | linux | 0 | 6.12.30-1 |
| Linux | Kernel | 5.6.0 | 5.10.238 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.60.5 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.60.5 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_13 | 0 | 1-150600.1.5.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_13 | 0 | 1-150600.13.6.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.60.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.60.5 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.60.5.150600.12.26.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.60.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.60.4 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco | 0 | 6.4.0-15061.28.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco_debug | 0 | 6.4.0-15061.28.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-source-coco | 0 | 6.4.0-15061.28.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-syms-coco | 0 | 6.4.0-15061.28.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.60.3 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.60.3 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.60.4 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.60.4 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.60.5 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.43.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.43.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.43.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.60.5 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.44.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.44.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.44.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.44.1 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.60.3 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.60.4 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.43.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.60.4 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.60.5 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.60.5.150600.12.26.4 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.60.3 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.60.4 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.60.3 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.60.2 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.44.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.44.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.60.4 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.43.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.44.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.60.4 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.43.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.44.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.60.4 |
Related vulnerabilities
- CVE-2025-39885 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive… Also affects linux
- CVE-2025-39883 In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure… Also affects linux
- CVE-2025-39876 In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix… Also affects linux
- CVE-2025-39869 In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma… Also affects linux
- CVE-2025-39873 In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can… Also affects linux
- CVE-2025-39863 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix… Also affects linux
- CVE-2025-39865 In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer… Also affects linux
- CVE-2025-39866 In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix… Also affects linux