In the Linux kernel, the following vulnerability has been resolved:
bonding: change ipsec_lock from spin lock to mutex
In the cited commit, bond->ipsec_lock is added to protect ipsec_list, hence xdo_dev_state_add and xdo_dev_state_delete are called inside this lock. As ipsec_lock is a spin lock and such xfrmdev ops may sleep, "scheduling while atomic" will be triggered when changing bond's active slave.
[ 101.055189] BUG: scheduling while atomic: bash/902/0x00000200 [ 101.055726] Modules linked in: [ 101.058211] CPU: 3 PID: 902 Comm: bash Not tainted 6.9.0-rc4+ #1 [ 101.058760] Hardware name: [ 101.059434] Call Trace: [ 101.059436] <TASK> [ 101.060873] dump_stack_lvl+0x51/0x60 [ 101.061275] __schedule_bug+0x4e/0x60 [ 101.061682] __schedule+0x612/0x7c0 [ 101.062078] ? __mod_timer+0x25c/0x370 [ 101.062486] schedule+0x25/0xd0 [ 101.062845] schedule_timeout+0x77/0xf0 [ 101.063265] ? asm_common_interrupt+0x22/0x40 [ 101.063724] ? __bpf_trace_itimer_state+0x10/0x10 [ 101.064215] __wait_for_common+0x87/0x190 [ 101.064648] ? usleep_range_state+0x90/0x90 [ 101.065091] cmd_exec+0x437/0xb20 [mlx5_core] [ 101.065569] mlx5_cmd_do+0x1e/0x40 [mlx5_core] [ 101.066051] mlx5_cmd_exec+0x18/0x30 [mlx5_core] [ 101.066552] mlx5_crypto_create_dek_key+0xea/0x120 [mlx5_core] [ 101.067163] ? bonding_sysfs_store_option+0x4d/0x80 [bonding] [ 101.067738] ? kmalloc_trace+0x4d/0x350 [ 101.068156] mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core] [ 101.068747] mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core] [ 101.069312] bond_change_active_slave+0x392/0x900 [bonding] [ 101.069868] bond_option_active_slave_set+0x1c2/0x240 [bonding] [ 101.070454] __bond_opt_set+0xa6/0x430 [bonding] [ 101.070935] __bond_opt_set_notify+0x2f/0x90 [bonding] [ 101.071453] bond_opt_tryset_rtnl+0x72/0xb0 [bonding] [ 101.071965] bonding_sysfs_store_option+0x4d/0x80 [bonding] [ 101.072567] kernfs_fop_write_iter+0x10c/0x1a0 [ 101.073033] vfs_write+0x2d8/0x400 [ 101.073416] ? alloc_fd+0x48/0x180 [ 101.073798] ksys_write+0x5f/0xe0 [ 101.074175] do_syscall_64+0x52/0x110 [ 101.074576] entry_SYSCALL_64_after_hwframe+0x4b/0x53
As bond_ipsec_add_sa_all and bond_ipsec_del_sa_all are only called from bond_change_active_slave, which requires holding the RTNL lock. And bond_ipsec_add_sa and bond_ipsec_del_sa are xfrm state xdo_dev_state_add and xdo_dev_state_delete APIs, which are in user context. So ipsec_lock doesn't have to be spin lock, change it to mutex, and thus the above issue can be resolved.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | May 15, 2025 | Sep 13, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-abi-stablelists | Feb 11, 2025 | Sep 13, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perfUpgrade kernel-tools-libs | Dec 12, 2024 | Sep 13, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 13, 2024 |
| Suse | — | Upgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-develUpgrade dlm-kmp-defaultUpgrade dtb-apmUpgrade kernel-default-extraUpgrade kernel-rt_debug-vdsoUpgrade dtb-amlogicUpgrade kernel-macrosUpgrade kernel-syms-rtUpgrade kernel-obs-qaUpgrade kernel-devel-rtUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-rtUpgrade kernel-defaultUpgrade dlm-kmp-rtUpgrade dtb-renesasUpgrade dtb-socionextUpgrade kernel-kvmsmallUpgrade kernel-rtUpgrade dtb-mediatekUpgrade kernel-debugUpgrade kernel-64kb-develUpgrade dtb-qcomUpgrade reiserfs-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade dtb-hisiliconUpgrade kernel-docsUpgrade kselftests-kmp-defaultUpgrade kernel-default-base-rebuildUpgrade kernel-default-baseUpgrade kernel-azure-livepatch-develUpgrade kernel-symsUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade dtb-rockchipUpgrade kernel-zfcpdumpUpgrade kernel-default-optionalUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-rtUpgrade dtb-armUpgrade kernel-develUpgrade dtb-xilinxUpgrade kernel-azure-vdsoUpgrade dlm-kmp-azureUpgrade dtb-nvidiaUpgrade kselftests-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-develUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmall-develUpgrade kernel-default-vdsoUpgrade dlm-kmp-64kbUpgrade kernel-syms-azureUpgrade kernel-azureUpgrade dtb-amdUpgrade kernel-rt_debug-develUpgrade dtb-exynosUpgrade kernel-rt-vdsoUpgrade cluster-md-kmp-azureUpgrade kernel-source-vanillaUpgrade dtb-freescaleUpgrade kernel-64kb-extraUpgrade dtb-appleUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debugUpgrade kernel-64kbUpgrade kernel-obs-buildUpgrade dtb-lgUpgrade dtb-broadcomUpgrade cluster-md-kmp-rtUpgrade dtb-allwinnerUpgrade gfs2-kmp-azureUpgrade dtb-marvellUpgrade dtb-alteraUpgrade kernel-default-livepatchUpgrade kernel-azure-extraUpgrade kernel-devel-azureUpgrade kernel-docs-htmlUpgrade kernel-rt-optionalUpgrade kernel-debug-develUpgrade kernel-azure-optionalUpgrade dtb-sprdUpgrade kernel-azure-develUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-sourceUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-extraUpgrade gfs2-kmp-defaultUpgrade dtb-caviumUpgrade dtb-amazonUpgrade ocfs2-kmp-azure | Dec 5, 2025 | Oct 10, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-oem-22.04cUpgrade linux-image-oem-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-kvmUpgrade linux-image-awsUpgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-azureUpgrade linux-image-raspiUpgrade linux-image-nvidia-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-22.04dUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-6.8.0-1020-azureUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1020-awsUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-generic-lpaeUpgrade linux-image-virtualUpgrade linux-image-oem-24.04aUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-genericUpgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oracleUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-oem-22.04Upgrade linux-image-generic-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-nvidiaUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1018-oemUpgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-gkeopUpgrade linux-image-ibmUpgrade linux-image-ibm-classicUpgrade linux-image-nvidia-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oem-22.04aUpgrade linux-image-azure-fdeUpgrade linux-image-oracle-64kUpgrade linux-image-ibm-lts-24.04 | Dec 13, 2024 | Sep 13, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub