CVE-2025-38094

What it actually does

Deadlock in macb_halt_tx when THALT is asserted but TGO remains set; interrupt-disabled context prevents jiffies updates so the polling loop never terminates.

Why it matters to the business

Network interface on affected Linux systems can hang indefinitely, causing loss of network connectivity and requiring a reboot; high prevalence in embedded and server deployments increases operational downtime risk.

How an attack unfolds

An attacker or workload triggers the macb transmit halt path under conditions that leave TGO asserted while interrupts are disabled; the jiffies-based timeout never fires, locking the CPU and freezing the interface. Listed threat actors have targeted similar Linux kernel race conditions for privilege escalation or denial of service.

How to fix it

Update to Linux kernel commit 0772a608d799ac0d127c0a36047a2725777aba9d or later; for render-template-fips (Chainguard) upgrade to 1.0.7-r2. Reboot after patching and verify the driver no longer uses jiffies for the halt timeout.

How to confirm the fix worked

Confirm the running kernel contains commit 0772a608d799ac0d127c0a36047a2725777aba9d; exercise macb transmit halt paths under load and verify the interface recovers within the retry limit instead of deadlocking.

Typical attack path

1. Identify systems running vulnerable macb driver (Cadence GEM on sama5d4 or similar SoCs)
2. Send traffic or issue commands that cause transmit queue halt while interrupts are masked
3. Trigger the infinite loop in macb_halt_tx
4. Observe permanent network interface lockup and system unresponsiveness

How to detect it

Search kernel logs and dmesg for macb_halt_tx entries, repeated transmit timeout messages, or indications of the interface remaining in halted state for extended periods; correlate with network interface reset failures on Cadence GEM hardware.

What your security team should do

• Prioritize patching of all systems using Cadence macb/GEM Ethernet controllers within the next maintenance window
• Monitor EPSS trend and any new exploit reports given the +20% rise
• Test the updated driver on representative sama5d4 and similar hardware before broad deployment
• Review network driver logs for repeated transmit halt attempts as an early indicator of exposure