CVE-2025-37859
09.05.2025, 07:16
In the Linux kernel, the following vulnerability has been resolved: page_pool: avoid infinite loop to schedule delayed worker We noticed the kworker in page_pool_release_retry() was waken up repeatedly and infinitely in production because of the buggy driver causing the inflight less than 0 and warning us in page_pool_inflight()[1]. Since the inflight value goes negative, it means we should not expect the whole page_pool to get back to work normally. This patch mitigates the adverse effect by not rescheduling the kworker when detecting the inflight negative in page_pool_release_retry(). [1] [Mon Feb 10 20:36:11 2025] ------------[ cut here ]------------ [Mon Feb 10 20:36:11 2025] Negative(-51446) inflight packet-pages ... [Mon Feb 10 20:36:11 2025] Call Trace: [Mon Feb 10 20:36:11 2025] page_pool_release_retry+0x23/0x70 [Mon Feb 10 20:36:11 2025] process_one_work+0x1b1/0x370 [Mon Feb 10 20:36:11 2025] worker_thread+0x37/0x3a0 [Mon Feb 10 20:36:11 2025] kthread+0x11a/0x140 [Mon Feb 10 20:36:11 2025] ? process_one_work+0x370/0x370 [Mon Feb 10 20:36:11 2025] ? __kthread_cancel_work+0x40/0x40 [Mon Feb 10 20:36:11 2025] ret_from_fork+0x35/0x40 [Mon Feb 10 20:36:11 2025] ---[ end trace ebffe800f33e7e34 ]--- Note: before this patch, the above calltrace would flood the dmesg due to repeated reschedule of release_dw kworker.
| Vendor | Product | Version |
|---|---|---|
| linux | linux_kernel | 5.3.18 ≤ 𝑥 < 5.4 |
| linux | linux_kernel | 5.4.5 ≤ 𝑥 < 5.4.293 |
| linux | linux_kernel | 5.5 ≤ 𝑥 < 5.10.237 |
| linux | linux_kernel | 5.11 ≤ 𝑥 < 5.15.181 |
| linux | linux_kernel | 5.16 ≤ 𝑥 < 6.1.135 |
| linux | linux_kernel | 6.2 ≤ 𝑥 < 6.6.88 |
| linux | linux_kernel | 6.7 ≤ 𝑥 < 6.12.24 |
| linux | linux_kernel | 6.13 ≤ 𝑥 < 6.13.12 |
| linux | linux_kernel | 6.14 ≤ 𝑥 < 6.14.3 |
| debian | debian_linux | 11.0 |
𝑥
= Vulnerable software versions
Debian Releases
Common Weakness Enumeration
References