Medium 5.5Published Sep 16, 2025

CVE-2025-39832net/mlx5: Fix lockdep assertion on sync reset unload event

Updated under an hour ago (Oct 27, 2026, 3:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix lockdep assertion on sync reset unload event Fix lockdep assertion triggered during sync reset unload event. When the sync reset flow is initiated using the devlink reload fw_activate option, the PF already holds the devlink lock while handling unload event. In this case, delegate sync reset unload event handling back to the devlink callback process to avoid double-locking and resolve the lockdep warning. Kernel log: WARNING: CPU: 9 PID: 1578 at devl_assert_locked+0x31/0x40 [...] Call Trace: <TASK> mlx5_unload_one_devl_locked+0x2c/0xc0 [mlx5_core] mlx5_sync_reset_unload_event+0xaf/0x2f0 [mlx5_core] process_one_work+0x222/0x640 worker_thread+0x199/0x350 kthread+0x10b/0x230 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x8e/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>

CVSS: 5.5 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-667
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7a9770f1bfeaeddf5afabd3244e2c4c4966be37d before ddac9d0fe2493dd550cbfc75eeaf31e9b6dac959; 7a9770f1bfeaeddf5afabd3244e2c4c4966be37d builds before 0c87dba9ccd3801d3b503f0b4fd41be343af4f06; 7a9770f1bfeaeddf5afabd3244e2c4c4966be37d builds before 06d897148e79638651800d851a69547b56b4be2e; from 7a9770f1bfeaeddf5afabd3244e2c4c4966be37d before 902a8bc23a24882200f57cadc270e15a2cfaf2bb	CNA record
linux linux_kernel linux:linux_kernel	from 6.5 before 6.6.104; from 6.7 before 6.12.45; from 6.13 before 6.16.5; 6.17; 6.17; 6.17	NVD

References

References

https://git.kernel.org/stable/c/ddac9d0fe2493dd550cbfc75eeaf31e9b6dac959	patch
https://git.kernel.org/stable/c/0c87dba9ccd3801d3b503f0b4fd41be343af4f06	patch
https://git.kernel.org/stable/c/06d897148e79638651800d851a69547b56b4be2e	patch
https://git.kernel.org/stable/c/902a8bc23a24882200f57cadc270e15a2cfaf2bb	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.