In the Linux kernel, the following vulnerability has been resolved:
bonding: change ipsec_lock from spin lock to mutex
In the cited commit, bond->ipsec_lock is added to protect ipsec_list, hence xdo_dev_state_add and xdo_dev_state_delete are called inside this lock. As ipsec_lock is a spin lock and such xfrmdev ops may sleep, "scheduling while atomic" will be triggered when changing bond's active slave.
[ 101.055189] BUG: scheduling while atomic: bash/902/0x00000200 [ 101.055726] Modules linked in: [ 101.058211] CPU: 3 PID: 902 Comm: bash Not tainted 6.9.0-rc4+ #1 [ 101.058760] Hardware name: [ 101.059434] Call Trace: [ 101.059436] <TASK> [ 101.060873] dump_stack_lvl+0x51/0x60 [ 101.061275] __schedule_bug+0x4e/0x60 [ 101.061682] __schedule+0x612/0x7c0 [ 101.062078] ? __mod_timer+0x25c/0x370 [ 101.062486] schedule+0x25/0xd0 [ 101.062845] schedule_timeout+0x77/0xf0 [ 101.063265] ? asm_common_interrupt+0x22/0x40 [ 101.063724] ? __bpf_trace_itimer_state+0x10/0x10 [ 101.064215] __wait_for_common+0x87/0x190 [ 101.064648] ? usleep_range_state+0x90/0x90 [ 101.065091] cmd_exec+0x437/0xb20 [mlx5_core] [ 101.065569] mlx5_cmd_do+0x1e/0x40 [mlx5_core] [ 101.066051] mlx5_cmd_exec+0x18/0x30 [mlx5_core] [ 101.066552] mlx5_crypto_create_dek_key+0xea/0x120 [mlx5_core] [ 101.067163] ? bonding_sysfs_store_option+0x4d/0x80 [bonding] [ 101.067738] ? kmalloc_trace+0x4d/0x350 [ 101.068156] mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core] [ 101.068747] mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core] [ 101.069312] bond_change_active_slave+0x392/0x900 [bonding] [ 101.069868] bond_option_active_slave_set+0x1c2/0x240 [bonding] [ 101.070454] __bond_opt_set+0xa6/0x430 [bonding] [ 101.070935] __bond_opt_set_notify+0x2f/0x90 [bonding] [ 101.071453] bond_opt_tryset_rtnl+0x72/0xb0 [bonding] [ 101.071965] bonding_sysfs_store_option+0x4d/0x80 [bonding] [ 101.072567] kernfs_fop_write_iter+0x10c/0x1a0 [ 101.073033] vfs_write+0x2d8/0x400 [ 101.073416] ? alloc_fd+0x48/0x180 [ 101.073798] ksys_write+0x5f/0xe0 [ 101.074175] do_syscall_64+0x52/0x110 [ 101.074576] entry_SYSCALL_64_after_hwframe+0x4b/0x53
As bond_ipsec_add_sa_all and bond_ipsec_del_sa_all are only called from bond_change_active_slave, which requires holding the RTNL lock. And bond_ipsec_add_sa and bond_ipsec_del_sa are xfrm state xdo_dev_state_add and xdo_dev_state_delete APIs, which are in user context. So ipsec_lock doesn't have to be spin lock, change it to mutex, and thus the above issue can be resolved.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution existsUpgrade linux | May 15, 2025 | Sep 13, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perf | Feb 11, 2025 | Sep 13, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel | Dec 12, 2024 | Sep 13, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 13, 2024 |
| Suse | — | Upgrade kernel-default-livepatch-develUpgrade kernel-devel-rtUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-defaultUpgrade dtb-nvidiaUpgrade kernel-obs-qaUpgrade kernel-default-base-rebuildUpgrade kernel-zfcpdumpUpgrade dlm-kmp-azureUpgrade kernel-azure-livepatch-develUpgrade dtb-armUpgrade kernel-macrosUpgrade kernel-docsUpgrade kernel-kvmsmallUpgrade kernel-syms-rtUpgrade dlm-kmp-rtUpgrade dtb-qcomUpgrade kernel-64kb-develUpgrade dtb-hisiliconUpgrade kernel-default-baseUpgrade kselftests-kmp-rtUpgrade dtb-amlogicUpgrade cluster-md-kmp-defaultUpgrade kernel-symsUpgrade kernel-rt-develUpgrade kernel-rt_debug-vdsoUpgrade kselftests-kmp-defaultUpgrade kernel-debugUpgrade kernel-rt-livepatchUpgrade kernel-default-optionalUpgrade dtb-socionextUpgrade dtb-rockchipUpgrade reiserfs-kmp-azureUpgrade dtb-renesasUpgrade dtb-mediatekUpgrade kernel-rt-livepatch-develUpgrade kernel-rtUpgrade reiserfs-kmp-defaultUpgrade dtb-apmUpgrade kernel-default-extraUpgrade kernel-defaultUpgrade kernel-develUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade dtb-xilinxUpgrade gfs2-kmp-rtUpgrade kernel-azure-vdsoUpgrade cluster-md-kmp-azureUpgrade kernel-source-vanillaUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-develUpgrade dtb-amazonUpgrade dtb-freescaleUpgrade kernel-azure-extraUpgrade kselftests-kmp-azureUpgrade kernel-default-livepatchUpgrade gfs2-kmp-azureUpgrade dtb-alteraUpgrade kernel-devel-azureUpgrade dtb-marvellUpgrade dtb-allwinnerUpgrade kernel-syms-azureUpgrade kernel-rt_debug-develUpgrade dtb-exynosUpgrade ocfs2-kmp-64kbUpgrade kernel-source-rtUpgrade dtb-caviumUpgrade dlm-kmp-64kbUpgrade kernel-azureUpgrade dtb-amdUpgrade ocfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-rt-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-sourceUpgrade dtb-broadcomUpgrade kernel-rt_debugUpgrade kernel-obs-buildUpgrade kernel-64kbUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade dtb-lgUpgrade kselftests-kmp-64kbUpgrade dtb-appleUpgrade kernel-default-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-64kb-optionalUpgrade kernel-docs-htmlUpgrade dtb-sprdUpgrade kernel-rt-optionalUpgrade kernel-azure-optionalUpgrade kernel-debug-develUpgrade kernel-azure-develUpgrade kernel-rt-vdsoUpgrade kernel-64kb-extra | Dec 5, 2025 | Oct 10, 2024 |
| Ubuntu | — | Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-kvmUpgrade linux-image-awsUpgrade linux-image-oem-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-raspiUpgrade linux-image-azureUpgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-gkeUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1020-azureUpgrade linux-image-oem-22.04cUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-lowlatencyUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-virtualUpgrade linux-image-oracleUpgrade linux-image-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-gcpUpgrade linux-image-6.8.0-1020-awsUpgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oem-22.04Upgrade linux-image-ibm-classicUpgrade linux-image-ibmUpgrade linux-image-nvidiaUpgrade linux-image-gkeop-6.8Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-azure-fdeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-1018-oemUpgrade linux-image-genericUpgrade linux-image-gkeopUpgrade linux-image-oem-24.04a | Dec 13, 2024 | Sep 13, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub