Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-38326— aoe: clean device rq_list in aoedev_downdev()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于aoe驱动中未清理rq_list，可能导致队列冻结挂起。

AI Predicted 5.5 Difficulty: Easy EPSS 0.22% · P12

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 3582dd291788e9441c3ba9047e55089edb98da5c< ed52e9652ba41d362e9ec923077f6da23336f269 affected
3582dd291788e9441c3ba9047e55089edb98da5c< 64fc0bad62ed38874131dd0337d844a43bd1017e affected
3582dd291788e9441c3ba9047e55089edb98da5c< ef0b5bbbed7f220db2e9c73428f9a36e8dfc69ca affected
3582dd291788e9441c3ba9047e55089edb98da5c< 531aef4a1accb13b21a3b82ec29955f4733367d5 affected
3582dd291788e9441c3ba9047e55089edb98da5c< 8662ac79a63488e279b91c12a72b02bc0dc49f7b affected
3582dd291788e9441c3ba9047e55089edb98da5c< fa2a79f0da92614c5dc45c8b3d2638681c7734ee affected
3582dd291788e9441c3ba9047e55089edb98da5c< 00be74e1470af292c37a438b8e69dee47dcbf481 affected
3582dd291788e9441c3ba9047e55089edb98da5c< 7f90d45e57cb2ef1f0adcaf925ddffdfc5e680ca affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-38326

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
aoe: clean device rq_list in aoedev_downdev()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: aoe: clean device rq_list in aoedev_downdev() An aoe device's rq_list contains accepted block requests that are waiting to be transmitted to the aoe target. This queue was added as part of the conversion to blk_mq. However, the queue was not cleaned out when an aoe device is downed which caused blk_mq_freeze_queue() to sleep indefinitely waiting for those requests to complete, causing a hang. This fix cleans out the queue before calling blk_mq_freeze_queue().
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于aoe驱动中未清理rq_list，可能导致队列冻结挂起。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3582dd291788e9441c3ba9047e55089edb98da5c ~ ed52e9652ba41d362e9ec923077f6da23336f269 -
Linux Linux 4.20 -

II. Public POCs for CVE-2025-38326

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-38326

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-07-10 · 84 CVEs total

CVE-2025-38325 9.8 CRITICAL ksmbd: add free_transport ops in ksmbd connection
CVE-2025-38283 8.8 HIGH hisi_acc_vfio_pci: bugfix live migration function without VF device driver
CVE-2025-38290 8.8 HIGH wifi: ath12k: fix node corruption in ar->arvifs list
CVE-2025-38291 8.8 HIGH wifi: ath12k: Prevent sending WMI commands to firmware during firmware crash
CVE-2025-38293 8.8 HIGH wifi: ath11k: fix node corruption in ar->arvifs list
CVE-2025-38292 8.8 HIGH wifi: ath12k: fix invalid access to memory
CVE-2025-38343 8.3 HIGH wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
CVE-2025-38321 7.8 HIGH smb: Log an error when close_all_cached_dirs fails
CVE-2025-38303 7.8 HIGH Bluetooth: eir: Fix possible crashes on eir_create_adv_data
CVE-2025-38333 7.8 HIGH f2fs: fix to bail out in get_new_segment()
CVE-2025-38317 7.8 HIGH wifi: ath12k: Fix buffer overflow in debugfs
CVE-2025-38306 7.8 HIGH fs/fhandle.c: fix a race in call of has_locked_children()
CVE-2025-38278 7.8 HIGH octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback
CVE-2025-38270 7.8 HIGH net: drv: netdevsim: don't napi_complete() from netpoll
CVE-2025-38339 7.8 HIGH powerpc/bpf: fix JIT code size calculation of bpf trampoline
CVE-2025-38341 7.8 HIGH eth: fbnic: avoid double free when failing to DMA-map FW msg
CVE-2025-38346 7.8 HIGH ftrace: Fix UAF when lookup kallsym after ftrace disabled
CVE-2025-38276 7.8 HIGH fs/dax: Fix "don't skip locked entries when scanning entries"
CVE-2025-38273 7.8 HIGH net: tipc: fix refcount warning in tipc_aead_encrypt
CVE-2025-38287 7.5 HIGH IB/cm: Drop lockdep assert and WARN when freeing old msg

Showing top 20 of 84 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-38326

No comments yet

Leave a comment