In the Linux kernel, the following vulnerability has been resolved:
bonding: change ipsec_lock from spin lock to mutex
In the cited commit, bond->ipsec_lock is added to protect ipsec_list, hence xdo_dev_state_add and xdo_dev_state_delete are called inside this lock. As ipsec_lock is a spin lock and such xfrmdev ops may sleep, "scheduling while atomic" will be triggered when changing bond's active slave.
[ 101.055189] BUG: scheduling while atomic: bash/902/0x00000200 [ 101.055726] Modules linked in: [ 101.058211] CPU: 3 PID: 902 Comm: bash Not tainted 6.9.0-rc4+ #1 [ 101.058760] Hardware name: [ 101.059434] Call Trace: [ 101.059436] <TASK> [ 101.060873] dump_stack_lvl+0x51/0x60 [ 101.061275] __schedule_bug+0x4e/0x60 [ 101.061682] __schedule+0x612/0x7c0 [ 101.062078] ? __mod_timer+0x25c/0x370 [ 101.062486] schedule+0x25/0xd0 [ 101.062845] schedule_timeout+0x77/0xf0 [ 101.063265] ? asm_common_interrupt+0x22/0x40 [ 101.063724] ? __bpf_trace_itimer_state+0x10/0x10 [ 101.064215] __wait_for_common+0x87/0x190 [ 101.064648] ? usleep_range_state+0x90/0x90 [ 101.065091] cmd_exec+0x437/0xb20 [mlx5_core] [ 101.065569] mlx5_cmd_do+0x1e/0x40 [mlx5_core] [ 101.066051] mlx5_cmd_exec+0x18/0x30 [mlx5_core] [ 101.066552] mlx5_crypto_create_dek_key+0xea/0x120 [mlx5_core] [ 101.067163] ? bonding_sysfs_store_option+0x4d/0x80 [bonding] [ 101.067738] ? kmalloc_trace+0x4d/0x350 [ 101.068156] mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core] [ 101.068747] mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core] [ 101.069312] bond_change_active_slave+0x392/0x900 [bonding] [ 101.069868] bond_option_active_slave_set+0x1c2/0x240 [bonding] [ 101.070454] __bond_opt_set+0xa6/0x430 [bonding] [ 101.070935] __bond_opt_set_notify+0x2f/0x90 [bonding] [ 101.071453] bond_opt_tryset_rtnl+0x72/0xb0 [bonding] [ 101.071965] bonding_sysfs_store_option+0x4d/0x80 [bonding] [ 101.072567] kernfs_fop_write_iter+0x10c/0x1a0 [ 101.073033] vfs_write+0x2d8/0x400 [ 101.073416] ? alloc_fd+0x48/0x180 [ 101.073798] ksys_write+0x5f/0xe0 [ 101.074175] do_syscall_64+0x52/0x110 [ 101.074576] entry_SYSCALL_64_after_hwframe+0x4b/0x53
As bond_ipsec_add_sa_all and bond_ipsec_del_sa_all are only called from bond_change_active_slave, which requires holding the RTNL lock. And bond_ipsec_add_sa and bond_ipsec_del_sa are xfrm state xdo_dev_state_add and xdo_dev_state_delete APIs, which are in user context. So ipsec_lock doesn't have to be spin lock, change it to mutex, and thus the above issue can be resolved.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution existsUpgrade linux | May 15, 2025 | Sep 13, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perf | Feb 11, 2025 | Sep 13, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-toolsUpgrade kernelUpgrade python3-perfUpgrade kernel-tools-libs | Dec 12, 2024 | Sep 13, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 13, 2024 |
| Suse | — | Upgrade kselftests-kmp-azureUpgrade gfs2-kmp-azureUpgrade dtb-alteraUpgrade kernel-syms-azureUpgrade dtb-allwinnerUpgrade kernel-azureUpgrade dtb-appleUpgrade kernel-obs-buildUpgrade kernel-devel-azureUpgrade dtb-marvellUpgrade kselftests-kmp-64kbUpgrade cluster-md-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade kernel-sourceUpgrade dtb-sprdUpgrade kernel-rt-extraUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade dtb-amdUpgrade dtb-lgUpgrade kernel-source-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-docs-htmlUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azure-optionalUpgrade kernel-debug-develUpgrade kernel-rt-optionalUpgrade ocfs2-kmp-azureUpgrade dtb-caviumUpgrade gfs2-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-64kb-optionalUpgrade kernel-64kb-extraUpgrade cluster-md-kmp-azureUpgrade dtb-freescaleUpgrade kernel-64kbUpgrade kernel-source-vanillaUpgrade kernel-azure-extraUpgrade kernel-kvmsmall-develUpgrade kernel-default-livepatchUpgrade dlm-kmp-64kbUpgrade kernel-rt_debugUpgrade kernel-azure-develUpgrade dtb-amazonUpgrade kernel-rt_debug-develUpgrade kernel-default-develUpgrade dtb-exynosUpgrade dtb-broadcomUpgrade kernel-default-vdsoUpgrade kernel-default-extraUpgrade dtb-apmUpgrade kernel-obs-qaUpgrade kernel-docsUpgrade kernel-default-livepatch-develUpgrade dtb-socionextUpgrade dtb-renesasUpgrade kernel-syms-rtUpgrade kernel-kvmsmallUpgrade kernel-devel-rtUpgrade dlm-kmp-rtUpgrade kernel-rtUpgrade kernel-defaultUpgrade dtb-mediatekUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-develUpgrade gfs2-kmp-rtUpgrade kernel-default-optionalUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-64kbUpgrade dtb-rockchipUpgrade ocfs2-kmp-rtUpgrade kernel-rt-livepatchUpgrade dtb-xilinxUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-develUpgrade kselftests-kmp-rtUpgrade dtb-hisiliconUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-symsUpgrade kernel-default-baseUpgrade kernel-debugUpgrade kernel-64kb-develUpgrade dtb-qcomUpgrade kernel-zfcpdumpUpgrade reiserfs-kmp-rtUpgrade dtb-amlogicUpgrade dlm-kmp-defaultUpgrade kernel-macrosUpgrade dtb-nvidiaUpgrade dtb-armUpgrade dlm-kmp-azureUpgrade kernel-default-base-rebuildUpgrade kernel-azure-livepatch-devel | Dec 5, 2025 | Oct 10, 2024 |
| Ubuntu | — | Upgrade linux-image-ibm-classicUpgrade linux-image-nvidiaUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-6.8.0-1018-oemUpgrade linux-image-genericUpgrade linux-image-lowlatencyUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-gkeopUpgrade linux-image-oem-22.04bUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-gcpUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1020-awsUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-nvidia-64kUpgrade linux-image-virtualUpgrade linux-image-oracleUpgrade linux-image-azure-fdeUpgrade linux-image-oem-22.04aUpgrade linux-image-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-6.8.0-1020-azureUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-22.04cUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-azureUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-awsUpgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-gkeUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1019-gcp | Dec 13, 2024 | Sep 13, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub