CVE-2025-38569

What it actually does

Calling dma_free_coherent() while holding a spin_lock_bh in be_cmd_set_mac_list leads to invalid opcode and kernel BUG at vmalloc.c during vunmap when SRIOV VFs are configured via be_vf_setup and related paths.

Why it matters to the business

Systems using affected benet network drivers experience immediate kernel crashes upon enabling SRIOV virtual functions, causing downtime, loss of network connectivity, and requiring reboots or rollbacks that disrupt operations and increase maintenance overhead.

How an attack unfolds

An attacker with local access writes to the sriov_numvfs sysfs attribute on a benet device, triggering be_pci_sriov_configure which calls be_vf_setup and be_vf_eth_addr_config; this invokes be_cmd_set_mac_list under spin_lock_bh, leading to dma_free_coherent and subsequent vunmap crash.

How to fix it

Upgrade Linux kernel to version 5.4.297 or later, or apply the referenced commit 3697e37e012bbd2bb5a5b467689811ba097b2eff; for Chainguard packages update openjdk-17-openj9 and related variants to 0.53.0-r0 or newer.

How to confirm the fix worked

Confirm kernel version is at or above the fixed release, test VF creation with sriov_numvfs without observing BUG at mm/vmalloc.c or Oops in vunmap, and verify no spin_lock held during dma_free_coherent calls in be_cmd_set_mac_list.

Typical attack path

1. Obtain local unprivileged or privileged shell on affected Linux system
2. Identify benet network device supporting SRIOV
3. Write value greater than zero to /sys/.../sriov_numvfs
4. Trigger be_cmd_set_mac_list path under lock
5. Cause kernel panic via improper DMA free

How to detect it

Search kernel logs for Oops involving vunmap or invalid opcode during be_cmd_set_mac_list or be_vf_setup calls; inspect dmesg and journalctl for traces showing sriov_numvfs_store followed by __iommu_dma_free crash.

What your security team should do

• Prioritize kernel upgrades on systems using benet SRIOV within 30 days due to crash risk
• Disable SRIOV on benet devices until patched if VF creation is not required
• Monitor for related kernel stability issues in container and virtualization environments
• Review downstream package updates in distributions depending on the stable kernel tree