Deadlock Vulnerability in Linux Kernel virtio-net Driver

CVE-2025-38551

What is CVE-2025-38551?

A deadlock vulnerability exists in the virtio-net driver of the Linux kernel, triggered during the probing phase when a VMM sends a VIRTIO_NET_S_ANNOUNCE request. This issue can result in a recursive locking scenario involving the rtnl_lock(), leading to significant delays and potential system instability. The lock contention is caused by the virtio-net driver's inability to handle configuration changes smoothly while still probing, which complicates its operation and can degrade performance in virtualized environments.

References