CVE-2025-39832

What it actually does

Triggers lockdep assertion warning during sync reset unload when PF already holds devlink lock, causing mlx5_unload_one_devl_locked to attempt double acquisition via mlx5_sync_reset_unload_event.

Why it matters to the business

Produces kernel warnings and potential instability on systems with mlx5 network adapters during firmware activation reloads, raising operational risk for high-availability networking environments with moderate ecosystem prevalence.

How an attack unfolds

An attacker initiates devlink reload fw_activate on an affected mlx5 system, causing the sync reset unload path to execute while the lock is held and producing the double-lock condition observed in worker threads; related threat actors such as VMSCAPE have targeted similar Linux kernel race conditions for privilege escalation.

How to fix it

Upgrade to fixed kernel containing commit ddac9d0fe2493dd550cbfc75eeaf31e9b6dac959 or Debian sane-backends packages version 1.0.11-1; avoid devlink reload fw_activate on unpatched systems until updated.

How to confirm the fix worked

Confirm absence of WARNING at devl_assert_locked during mlx5_sync_reset_unload_event in kernel logs after applying the patch and re-testing devlink reload fw_activate flows.

Typical attack path

1. Gain local or container access to initiate devlink reload fw_activate
2. Trigger mlx5 sync reset unload event handling
3. Execute mlx5_sync_reset_unload_event while devlink lock is held
4. Observe lockdep warning and call trace in kernel logs

How to detect it

Review kernel logs for entries containing devl_assert_locked, mlx5_unload_one_devl_locked, mlx5_sync_reset_unload_event, and worker_thread traces; correlate with devlink reload events.

• WARNING: CPU:.*at devl_assert_locked+0x31/0x40
• mlx5_unload_one_devl_locked+0x2c/0xc0 [mlx5_core]
• mlx5_sync_reset_unload_event+0xaf/0x2f0 [mlx5_core]
• Call Trace:.*mlx5_sync_reset_unload_event

What your security team should do

• Apply fixed kernel versions containing ddac9d0fe2493dd550cbfc75eeaf31e9b6dac959 without delay due to 406 days since publication
• Monitor kernel logs for devl_assert_locked assertions on mlx5 systems
• Restrict devlink reload privileges to trusted processes until patched