CVE-2025-38119

What it actually does

Race condition in UFS error handler where UFSHCD_EH_IN_PROGRESS is set before ufshcd_rpm_get_sync(), causing deadlock because runtime resume submits SCSI commands that are blocked by the flag.

Why it matters to the business

Systems using UFS storage may experience hangs during error recovery, leading to downtime and reduced availability especially on Linux kernel deployments with high ecosystem prevalence.

How an attack unfolds

An attacker triggers UFS error paths (such as power management events) while the handler is active; the misordered flag prevents resume completion, resulting in indefinite wait. Threat actors including Advanced Spyware Campaign and VMSCAPE have been associated with similar Linux kernel issues though this instance centers on stability rather than direct privilege escalation.

How to fix it

Update to fixed versions: containernetworking-plugins (AlmaLinux:9) 1:1.6.2-2.el9_6 or Linux kernel commit f210ea4e7a790c9f5e613e5302175abd539fe9d5 in stable trees. Apply the ordering change so UFSHCD_EH_IN_PROGRESS is set after successful rpm_get_sync.

How to confirm the fix worked

Confirm kernel version or patch level matches fixed commit; reproduce error injection paths and verify handler no longer deadlocks on resume; monitor for absence of schedule_timeout waits in ufshcd_err_handler.

Typical attack path

1. Trigger UFS device error or runtime suspend/resume cycle
2. Error handler runs and calls ufshcd_rpm_get_sync before setting EH flag
3. Resume path submits SCSI command but queuecommand returns busy due to unset flag state
4. Hang occurs waiting on START_STOP or completion

How to detect it

Review kernel logs for repeated ufshcd_err_handler entries followed by schedule_timeout or wait_for_completion_io_timeout on START_STOP; correlate with UFS runtime resume attempts and threat actor patterns such as those in Advanced Spyware Campaign or VMSCAPE Linux kernel activity.

What your security team should do

• Prioritize patching Linux kernel on all UFS-equipped systems given 481 days since publication and slight EPSS increase
• Monitor for similar race conditions in storage error paths
• Test error recovery under load after upgrade