In the Linux kernel, the following vulnerability has been resolved:
bonding: change ipsec_lock from spin lock to mutex
In the cited commit, bond->ipsec_lock is added to protect ipsec_list, hence xdo_dev_state_add and xdo_dev_state_delete are called inside this lock. As ipsec_lock is a spin lock and such xfrmdev ops may sleep, "scheduling while atomic" will be triggered when changing bond's active slave.
[ 101.055189] BUG: scheduling while atomic: bash/902/0x00000200 [ 101.055726] Modules linked in: [ 101.058211] CPU: 3 PID: 902 Comm: bash Not tainted 6.9.0-rc4+ #1 [ 101.058760] Hardware name: [ 101.059434] Call Trace: [ 101.059436] <TASK> [ 101.060873] dump_stack_lvl+0x51/0x60 [ 101.061275] __schedule_bug+0x4e/0x60 [ 101.061682] __schedule+0x612/0x7c0 [ 101.062078] ? __mod_timer+0x25c/0x370 [ 101.062486] schedule+0x25/0xd0 [ 101.062845] schedule_timeout+0x77/0xf0 [ 101.063265] ? asm_common_interrupt+0x22/0x40 [ 101.063724] ? __bpf_trace_itimer_state+0x10/0x10 [ 101.064215] __wait_for_common+0x87/0x190 [ 101.064648] ? usleep_range_state+0x90/0x90 [ 101.065091] cmd_exec+0x437/0xb20 [mlx5_core] [ 101.065569] mlx5_cmd_do+0x1e/0x40 [mlx5_core] [ 101.066051] mlx5_cmd_exec+0x18/0x30 [mlx5_core] [ 101.066552] mlx5_crypto_create_dek_key+0xea/0x120 [mlx5_core] [ 101.067163] ? bonding_sysfs_store_option+0x4d/0x80 [bonding] [ 101.067738] ? kmalloc_trace+0x4d/0x350 [ 101.068156] mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core] [ 101.068747] mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core] [ 101.069312] bond_change_active_slave+0x392/0x900 [bonding] [ 101.069868] bond_option_active_slave_set+0x1c2/0x240 [bonding] [ 101.070454] __bond_opt_set+0xa6/0x430 [bonding] [ 101.070935] __bond_opt_set_notify+0x2f/0x90 [bonding] [ 101.071453] bond_opt_tryset_rtnl+0x72/0xb0 [bonding] [ 101.071965] bonding_sysfs_store_option+0x4d/0x80 [bonding] [ 101.072567] kernfs_fop_write_iter+0x10c/0x1a0 [ 101.073033] vfs_write+0x2d8/0x400 [ 101.073416] ? alloc_fd+0x48/0x180 [ 101.073798] ksys_write+0x5f/0xe0 [ 101.074175] do_syscall_64+0x52/0x110 [ 101.074576] entry_SYSCALL_64_after_hwframe+0x4b/0x53
As bond_ipsec_add_sa_all and bond_ipsec_del_sa_all are only called from bond_change_active_slave, which requires holding the RTNL lock. And bond_ipsec_add_sa and bond_ipsec_del_sa are xfrm state xdo_dev_state_add and xdo_dev_state_delete APIs, which are in user context. So ipsec_lock doesn't have to be spin lock, change it to mutex, and thus the above issue can be resolved.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution existsUpgrade linux | May 15, 2025 | Sep 13, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel | Feb 11, 2025 | Sep 13, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Dec 12, 2024 | Sep 13, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 13, 2024 |
| Suse | — | Upgrade dtb-alteraUpgrade kernel-azure-extraUpgrade kselftests-kmp-azureUpgrade dtb-marvellUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade dtb-amazonUpgrade kernel-default-livepatchUpgrade ocfs2-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-devel-azureUpgrade kernel-rt-optionalUpgrade kernel-rt_debug-livepatch-develUpgrade kselftests-kmp-64kbUpgrade kernel-source-rtUpgrade dtb-caviumUpgrade kernel-default-develUpgrade kernel-azureUpgrade kernel-rt_debug-develUpgrade dtb-exynosUpgrade kernel-syms-azureUpgrade dtb-lgUpgrade kernel-obs-buildUpgrade kernel-rt-vdsoUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade kernel-debug-vdsoUpgrade kernel-azure-develUpgrade cluster-md-kmp-rtUpgrade kernel-64kb-optionalUpgrade kernel-default-vdsoUpgrade dtb-appleUpgrade dtb-amdUpgrade cluster-md-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade dtb-allwinnerUpgrade kernel-rt-extraUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-azureUpgrade kernel-rt_debugUpgrade ocfs2-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-64kbUpgrade dtb-freescaleUpgrade dtb-broadcomUpgrade kernel-sourceUpgrade kernel-kvmsmall-develUpgrade kernel-azure-optionalUpgrade kernel-docs-htmlUpgrade dtb-sprdUpgrade kernel-debug-develUpgrade kernel-docsUpgrade dtb-apmUpgrade kernel-symsUpgrade dtb-mediatekUpgrade kernel-default-base-rebuildUpgrade dtb-armUpgrade dlm-kmp-azureUpgrade gfs2-kmp-rtUpgrade kernel-rtUpgrade dtb-nvidiaUpgrade kernel-default-extraUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-develUpgrade kernel-obs-qaUpgrade kernel-macrosUpgrade dtb-amlogicUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-zfcpdumpUpgrade kernel-devel-rtUpgrade kernel-default-livepatch-develUpgrade dtb-socionextUpgrade dtb-renesasUpgrade kernel-syms-rtUpgrade kernel-kvmsmallUpgrade dlm-kmp-rtUpgrade kernel-rt-develUpgrade kernel-azure-livepatch-develUpgrade kernel-default-baseUpgrade kernel-debugUpgrade kernel-64kb-develUpgrade dtb-qcomUpgrade dtb-hisiliconUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade kernel-rt-livepatchUpgrade kernel-default-optionalUpgrade dtb-xilinxUpgrade dtb-rockchipUpgrade ocfs2-kmp-rtUpgrade kernel-defaultUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-vdso | Dec 5, 2025 | Oct 10, 2024 |
| Ubuntu | — | Upgrade linux-image-genericUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-oem-22.04bUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-virtualUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1018-oemUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oracleUpgrade linux-image-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatencyUpgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1020-awsUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-oem-24.04aUpgrade linux-image-azure-fdeUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidiaUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-oem-22.04cUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-oem-22.04dUpgrade linux-image-azureUpgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-raspiUpgrade linux-image-kvmUpgrade linux-image-awsUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-6.8.0-1020-azureUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-6.8.0-1017-oracle | Dec 13, 2024 | Sep 13, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub