5.5

CVE-2025-38151: debian debian_linux

CVSS: 5.5v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2025-38151DEBIAN-CVE-2025-38151
Published 03-07-2025Last modified 23-05-2026
Open JSON

Vulnerability summary

CVE-2025-38151 is a medium (CVSS 5.5) vulnerability in debian debian_linux. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.9% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.18%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 27 · Related 23
DLA-4328-1DSA-5973-1MGASA-2025-0218MGASA-2025-0219OPENSUSE-SU-2025:20081-1SUSE-SU-2025:02853-1

Timeline

  1. 03-07-2025
    PublishedVulnerability first disclosed.
  2. 23-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work The cited commit fixed a crash when cma_netevent_callback was called for a cma_id while work on that id from a previous call had not yet started. The work item was re-initialized in the second call, which corrupted the work item currently in the work queue. However, it left a problem when queue_work fails (because the item is still pending in the work queue from a previous call). In this case, cma_id_put (which is called in the work handler) is therefore not called. This results in a userspace process hang (zombie process). Fix this by calling cma_id_put() if queue_work fails.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

+0.02 pp

From 0.15% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu88 products
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
  • linux-aws-5.13All versions (No fix recorded)
  • linux-aws-5.19All versions (No fix recorded)
Debian2 products
Linux2 products
  • linux≥ 51003b2c872c63d28bcf5fbcc52cf7b05615f7b7, < 1ac40736c8c4255d8417b937c9715b193f4a87b3 | ≥ c2b169fc7a12665d8a675c1ff14bca1b9c63fb9a, < ac7897c0124066b9705ffca252a3662d54fc0c9b | ≥ d23fd7a539ac078df119707110686a5b226ee3bb, < 02e45168e0fd6fdc6f8f7c42c4b500857aa5efb0 | ≥ 45f5dcdd049719fb999393b30679605f16ebce14, < 8b05aa3692e45b8249379dc52b14acc6a104d2e5 | ≥ 45f5dcdd049719fb999393b30679605f16ebce14, < 92a251c3df8ea1991cd9fe00f1ab0cfce18d7711 | b172a4a0de254f1fcce7591833a9a63547c2f447 | ≥ 6.1.135, < 6.1.142 | ≥ 6.6.88, < 6.6.94 | ≥ 6.12.25, < 6.12.34 | ≥ 6.14.4, < 6.15 | 6.15
  • linux_kernelEOL≥ 6.1.135, < 6.1.142 | ≥ 6.6.88, < 6.6.94 | ≥ 6.12.25, < 6.12.34 | ≥ 6.14.4, < 6.15 | ≥ 6.15.1, < 6.15.3 | 6.15 | 6.15:rc3 | 6.15:rc4 | 6.15:rc5 | 6.15:rc6 | 6.15:rc7

3 vendors · 92 products

References

17 links
Show all 17 references