CVE-2025-38524 (GCVE-0-2025-38524)
Vulnerability from cvelistv5
Published
2025-08-16 11:12
Modified
2026-08-23 12:45
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recv-recv race of completed call If a call receives an event (such as incoming data), the call gets placed on the socket's queue and a thread in recvmsg can be awakened to go and process it. Once the thread has picked up the call off of the queue, further events will cause it to be requeued, and once the socket lock is dropped (recvmsg uses call->user_mutex to allow the socket to be used in parallel), a second thread can come in and its recvmsg can pop the call off the socket queue again. In such a case, the first thread will be receiving stuff from the call and the second thread will be blocked on call->user_mutex. The first thread can, at this point, process both the event that it picked call for and the event that the second thread picked the call for and may see the call terminate - in which case the call will be "released", decoupling the call from the user call ID assigned to it (RXRPC_USER_CALL_ID in the control message). The first thread will return okay, but then the second thread will wake up holding the user_mutex and, if it sees that the call has been released by the first thread, it will BUG thusly: kernel BUG at net/rxrpc/recvmsg.c:474! Fix this by just dequeuing the call and ignoring it if it is seen to be already released. We can't tell userspace about it anyway as the user call ID has become stale.
References
Impacted products
Vendor Product Version
Linux Linux Version: 248f219cb8bcbfbd7f132752d44afa2df7c241d1
Version: 248f219cb8bcbfbd7f132752d44afa2df7c241d1
Version: 248f219cb8bcbfbd7f132752d44afa2df7c241d1
Version: 248f219cb8bcbfbd7f132752d44afa2df7c241d1
Version: 248f219cb8bcbfbd7f132752d44afa2df7c241d1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/trace/events/rxrpc.h",
            "net/rxrpc/call_accept.c",
            "net/rxrpc/recvmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4aed0eeca58e26d752bb08b293b8dc75c6820b23",
              "status": "affected",
              "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1",
              "versionType": "git"
            },
            {
              "lessThan": "7692bde890061797f3dece0148d7859e85c55778",
              "status": "affected",
              "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1",
              "versionType": "git"
            },
            {
              "lessThan": "839fe96c15209dc2255c064bb44b636efe04f032",
              "status": "affected",
              "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1",
              "versionType": "git"
            },
            {
              "lessThan": "6c75a97a32a5fa2060c3dd30207e63b6914b606d",
              "status": "affected",
              "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1",
              "versionType": "git"
            },
            {
              "lessThan": "962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc",
              "status": "affected",
              "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/trace/events/rxrpc.h",
            "net/rxrpc/call_accept.c",
            "net/rxrpc/recvmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.100",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix recv-recv race of completed call\n\nIf a call receives an event (such as incoming data), the call gets placed\non the socket\u0027s queue and a thread in recvmsg can be awakened to go and\nprocess it.  Once the thread has picked up the call off of the queue,\nfurther events will cause it to be requeued, and once the socket lock is\ndropped (recvmsg uses call-\u003euser_mutex to allow the socket to be used in\nparallel), a second thread can come in and its recvmsg can pop the call off\nthe socket queue again.\n\nIn such a case, the first thread will be receiving stuff from the call and\nthe second thread will be blocked on call-\u003euser_mutex.  The first thread\ncan, at this point, process both the event that it picked call for and the\nevent that the second thread picked the call for and may see the call\nterminate - in which case the call will be \"released\", decoupling the call\nfrom the user call ID assigned to it (RXRPC_USER_CALL_ID in the control\nmessage).\n\nThe first thread will return okay, but then the second thread will wake up\nholding the user_mutex and, if it sees that the call has been released by\nthe first thread, it will BUG thusly:\n\n\tkernel BUG at net/rxrpc/recvmsg.c:474!\n\nFix this by just dequeuing the call and ignoring it if it is seen to be\nalready released.  We can\u0027t tell userspace about it anyway as the user call\nID has become stale."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The race is driven entirely by received rxrpc/UDP packets processed in net/rxrpc \u2014 DATA packets re-queue the call via rxrpc_notify_socket() and an ABORT packet completes it via rxrpc_input_abort(). A remote peer talking to a userspace AF_RXRPC service socket (the documented one-socket-per-service model, serviced by a worker thread pool) supplies every event needed.\nAC:L - The attacker controls the entire packet stream that creates both sides of the race \u2014 the extra DATA notification that re-queues the call and the ABORT that terminates it \u2014 and can retry indefinitely at high rate with no precondition outside their influence. In the local variant the attacker owns both recvmsg threads and both socket endpoints outright.\nPR:N - No capability check exists anywhere in net/rxrpc, and the DATA/ABORT packets that drive the race are handled by the rxrpc transport layer before any rxkad/rxgk or application-level credential verification. A completely unauthenticated remote peer can issue a call and abort it.\nUI:N - No victim action is required; the packets are consumed automatically by the kernel\u0027s rxrpc input path and the already-running service threads.\nS:U - The BUG() fires in the kernel and its effect is confined to that kernel\u0027s own security authority, with no crossing into a hypervisor, IOMMU, or other boundary.\nC:N - This is an unconditional assertion failure on a still-valid, still-refcounted call object \u2014 there is no out-of-bounds read, no use-after-free, and no data copied to userspace, so nothing is disclosed.\nI:N - No memory is written out of bounds and no kernel state is corrupted; the call structure remains intact and correctly referenced, so there is no modification primitive.\nA:H - BUG() executes ud2, producing a kernel oops that kills the thread \u2014 and a full panic/reboot on the many deployments running panic_on_oops. The dying thread also leaves call-\u003euser_mutex permanently locked and leaks call/socket references, hanging every other thread on that socket, and the attacker can repeat it at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:22.497Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4aed0eeca58e26d752bb08b293b8dc75c6820b23"
        },
        {
          "url": "https://git.kernel.org/stable/c/7692bde890061797f3dece0148d7859e85c55778"
        },
        {
          "url": "https://git.kernel.org/stable/c/839fe96c15209dc2255c064bb44b636efe04f032"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c75a97a32a5fa2060c3dd30207e63b6914b606d"
        },
        {
          "url": "https://git.kernel.org/stable/c/962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc"
        }
      ],
      "title": "rxrpc: Fix recv-recv race of completed call",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38524",
    "datePublished": "2025-08-16T11:12:18.314Z",
    "dateReserved": "2025-04-16T04:51:24.023Z",
    "dateUpdated": "2026-08-23T12:45:22.497Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.