CVE-2025-38440

What it actually does

Race condition between DIM disable and NAPI callbacks in mlx5e driver allows net_dim() to dereference a NULL pointer after the dim context is freed, resulting in kernel NULL pointer dereference and panic.

Why it matters to the business

Systems using affected Linux kernels with mlx5 network adapters can experience unexpected crashes and denial of service, disrupting network-dependent workloads until patched.

How an attack unfolds

An attacker with the ability to trigger network polling on an mlx5 interface (via busy polling, XDP, or socket receive paths) times DIM disable operations against active NAPI callbacks; once the pointer is cleared without synchronization, the next net_dim call crashes the kernel.

How to fix it

Upgrade the linux package on Debian 12 to version 6.1.147-1 or newer; apply the upstream synchronize_net() fix before freeing the DIM context; reboot after package installation.

How to confirm the fix worked

Confirm the running kernel version reports 6.1.147-1 or later; verify absence of the race by reviewing kernel source for the synchronize_net() call prior to dim pointer clear; monitor dmesg for resolved NULL dereference signatures during network load.

Typical attack path

1. Obtain local execution or network socket access on the target system
2. Initiate high-volume or busy-poll receive traffic on an mlx5 interface
3. Trigger concurrent DIM state changes that race with mlx5e_napi_poll
4. Force net_dim to follow a now-NULL dim pointer, causing panic

How to detect it

Search kernel logs and crash dumps for NULL pointer dereference traces containing net_dim, mlx5e_napi_poll, mlx5e_handle_rx_dim, and busy_poll_stop; correlate with mlx5_core module activity and recent DIM configuration changes.

• BUG: kernel NULL pointer dereference
• net_dim+0x23/0x190
• mlx5e_napi_poll
• mlx5e_handle_rx_dim
• asm_exc_page_fault

What your security team should do

• Prioritize kernel upgrade on all systems exposing mlx5 interfaces
• Schedule immediate reboot windows for production hosts after package update
• Add kernel panic and oops monitoring to existing alerting
• Review network configuration for unnecessary busy polling that increases exposure surface