{"cve":"CVE-2025-38720","nvd":{"published":"2025-09-04T16:15:41.710","modified":"2026-10-19T21:10:00.160","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hibmcge: fix rtnl deadlock issue\n\nCurrently, the hibmcge netdev acquires the rtnl_lock in\npci_error_handlers.reset_prepare() and releases it in\npci_error_handlers.reset_done().\n\nHowever, in the PCI framework:\npci_reset_bus - __pci_reset_slot - pci_slot_save_and_disable_locked -\n pci_dev_save_and_disable - err_handler->reset_prepare(dev);\n\nIn pci_slot_save_and_disable_locked():\n\tlist_for_each_entry(dev, &slot->bus->devices, bus_list) {\n\t\tif (!dev->slot || dev->slot!= slot)\n\t\t\tcontinue;\n\t\tpci_dev_save_and_disable(dev);\n\t\tif (dev->subordinate)\n\t\t\tpci_bus_save_and_disable_locked(dev->subordinate);\n\t}\n\nThis will iterate through all devices under the current bus and execute\nerr_handler->reset_prepare(), causing two devices of the hibmcge driver\nto sequentially request the rtnl_lock, leading to a deadlock.\n\nSince the driver now executes netif_device_detach()\nbefore the reset process, it will not concurrently with\nother netdev APIs, so there is no need to hold the rtnl_lock now.\n\nTherefore, this patch removes the rtnl_lock during the reset process and\nadjusts the position of HBG_NIC_STATE_RESETTING to ensure\nthat multiple resets are not executed concurrently.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-667"],"references":["https://git.kernel.org/stable/c/1343a8994ca7dba78f5dd818e89d68331c21c35d","https://git.kernel.org/stable/c/c875503a9b9082928d7d3fc60b5400d16fbfae4e","https://git.kernel.org/stable/c/d85a6346fd6f595c4914205762d0cdf35c004a5e"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-21T03:43:09.190223697+00:00"},"epss":{"cve":"CVE-2025-38720","score":0.00115,"percentile":0.01528,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}