CVE-2025-38496

What it actually does

The flaw allows scheduling while holding a spinlock in dm-bufio's do_global_cleanup when DM_BUFIO_CLIENT_NO_SLEEP is enabled via dm-verity's try_verify_in_tasklet option, triggering a sleeping function call from invalid atomic context.

Why it matters to the business

Systems using dm-verity with tasklet verification may experience kernel warnings, instability, or crashes during buffer eviction under cache pressure, leading to unplanned downtime and potential data access issues on affected Linux deployments.

How an attack unfolds

An attacker with local access configures dm-verity with try_verify_in_tasklet, reduces the dm-bufio cache size, and performs reads to trigger buffer eviction under spinlock, causing the scheduler to be invoked from atomic context and potentially destabilizing the kernel.

How to fix it

Update the Linux kernel to a version containing the dm-bufio fix for sched in atomic context. For Alpine v3.22 environments using the listed binutils package, ensure binutils 2.44-r0 or later is installed as a dependency baseline.

How to confirm the fix worked

Confirm kernel version includes the dm-bufio atomic context fix; reproduce the veritysetup and cache reduction steps to verify no BUG warning occurs; monitor dmesg for absence of sleeping function in atomic context messages.

Typical attack path

1. Format and activate a dm-verity target with try_verify_in_tasklet enabled
2. Reduce max_cache_size_bytes to force buffer eviction
3. Perform file reads on the mounted device to trigger do_global_cleanup
4. Induce scheduling while spinlock is held leading to BUG warning or kernel fault

How to detect it

Search kernel logs for BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c and references to dm_bufio_replacement_work or do_global_cleanup; correlate with dm-verity tasklet usage and cache size changes.

What your security team should do

• Prioritize kernel updates on systems using dm-verity with tasklet verification
• Review and disable try_verify_in_tasklet if immediate patching is delayed
• Monitor for related privilege escalation activity from listed threat actors
• Audit dm-bufio cache parameters in production workloads