CVE-2025-38326

What it actually does

Failure to drain the rq_list of pending block requests in aoedev_downdev() before blk_mq_freeze_queue() causes the freeze operation to block indefinitely.

Why it matters to the business

Systems using the aoe driver can experience complete unavailability and require manual intervention or reboot, disrupting storage operations and workloads that depend on the affected kernel.

How an attack unfolds

An attacker with local access triggers an aoe device down event (via normal driver teardown paths) while requests remain queued; the missing cleanup leaves blk_mq_freeze_queue() waiting forever, hanging the system. No remote unauthenticated path exists.

How to fix it

Upgrade the Linux kernel to a fixed release: linux-lts (Alpaquita:23) to 6.1.81-r0 or newer, linux-lts (Alpaquita:stream) to 6.6.58-r0 or 6.12.41-r0 or newer, or mainline to commit ed52e9652ba41d362e9ec923077f6da23336f269 or later. Rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking the git commit or package version; exercise aoe device down/up cycles in a test environment and verify blk_mq_freeze_queue() returns promptly.

Typical attack path

1. Obtain local execution on a system running a vulnerable kernel with the aoe driver loaded
2. Perform or induce an aoe device teardown that reaches aoedev_downdev()
3. Leave at least one request on the rq_list so the subsequent blk_mq_freeze_queue() cannot complete
4. Observe indefinite hang of the calling context and dependent kernel threads

How to detect it

Review kernel logs for aoe-related device down events immediately followed by hung task or blocked queue freeze warnings; correlate with process stalls in blk_mq or storage I/O paths.

What your security team should do

• Apply the listed kernel updates on all affected systems within the next maintenance window
• Prioritize hosts that expose the aoe driver or run storage workloads
• After patching, verify no residual aoe devices remain in a partially-downed state
• Monitor EPSS trend and re-evaluate if new exploit code appears