{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38524", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.023Z", "datePublished": "2025-08-16T11:12:18.314Z", "dateUpdated": "2026-08-05T12:02:36.993Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:36.993Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix recv-recv race of completed call\n\nIf a call receives an event (such as incoming data), the call gets placed\non the socket's queue and a thread in recvmsg can be awakened to go and\nprocess it. Once the thread has picked up the call off of the queue,\nfurther events will cause it to be requeued, and once the socket lock is\ndropped (recvmsg uses call->user_mutex to allow the socket to be used in\nparallel), a second thread can come in and its recvmsg can pop the call off\nthe socket queue again.\n\nIn such a case, the first thread will be receiving stuff from the call and\nthe second thread will be blocked on call->user_mutex. The first thread\ncan, at this point, process both the event that it picked call for and the\nevent that the second thread picked the call for and may see the call\nterminate - in which case the call will be \"released\", decoupling the call\nfrom the user call ID assigned to it (RXRPC_USER_CALL_ID in the control\nmessage).\n\nThe first thread will return okay, but then the second thread will wake up\nholding the user_mutex and, if it sees that the call has been released by\nthe first thread, it will BUG thusly:\n\n\tkernel BUG at net/rxrpc/recvmsg.c:474!\n\nFix this by just dequeuing the call and ignoring it if it is seen to be\nalready released. We can't tell userspace about it anyway as the user call\nID has become stale." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The race is driven entirely by received rxrpc/UDP packets processed in net/rxrpc — DATA packets re-queue the call via rxrpc_notify_socket() and an ABORT packet completes it via rxrpc_input_abort(). A remote peer talking to a userspace AF_RXRPC service socket (the documented one-socket-per-service model, serviced by a worker thread pool) supplies every event needed.\nAC:L - The attacker controls the entire packet stream that creates both sides of the race — the extra DATA notification that re-queues the call and the ABORT that terminates it — and can retry indefinitely at high rate with no precondition outside their influence. In the local variant the attacker owns both recvmsg threads and both socket endpoints outright.\nPR:N - No capability check exists anywhere in net/rxrpc, and the DATA/ABORT packets that drive the race are handled by the rxrpc transport layer before any rxkad/rxgk or application-level credential verification. A completely unauthenticated remote peer can issue a call and abort it.\nUI:N - No victim action is required; the packets are consumed automatically by the kernel's rxrpc input path and the already-running service threads.\nS:U - The BUG() fires in the kernel and its effect is confined to that kernel's own security authority, with no crossing into a hypervisor, IOMMU, or other boundary.\nC:N - This is an unconditional assertion failure on a still-valid, still-refcounted call object — there is no out-of-bounds read, no use-after-free, and no data copied to userspace, so nothing is disclosed.\nI:N - No memory is written out of bounds and no kernel state is corrupted; the call structure remains intact and correctly referenced, so there is no modification primitive.\nA:H - BUG() executes ud2, producing a kernel oops that kills the thread — and a full panic/reboot on the many deployments running panic_on_oops. The dying thread also leaves call->user_mutex permanently locked and leaks call/socket references, hanging every other thread on that socket, and the attacker can repeat it at will." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/trace/events/rxrpc.h", "net/rxrpc/call_accept.c", "net/rxrpc/recvmsg.c" ], "versions": [ { "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "7692bde890061797f3dece0148d7859e85c55778", "status": "affected", "versionType": "git" }, { "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "839fe96c15209dc2255c064bb44b636efe04f032", "status": "affected", "versionType": "git" }, { "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "6c75a97a32a5fa2060c3dd30207e63b6914b606d", "status": "affected", "versionType": "git" }, { "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/trace/events/rxrpc.h", "net/rxrpc/call_accept.c", "net/rxrpc/recvmsg.c" ], "versions": [ { "version": "4.9", "status": "affected" }, { "version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.100", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.40", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.8", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.100" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.12.40" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.15.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/7692bde890061797f3dece0148d7859e85c55778" }, { "url": "https://git.kernel.org/stable/c/839fe96c15209dc2255c064bb44b636efe04f032" }, { "url": "https://git.kernel.org/stable/c/6c75a97a32a5fa2060c3dd30207e63b6914b606d" }, { "url": "https://git.kernel.org/stable/c/962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc" } ], "title": "rxrpc: Fix recv-recv race of completed call", "x_generator": { "engine": "bippy-1.2.0" } } } }