{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-38638",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-04-16T04:51:24.030Z",
        "datePublished": "2025-08-22T16:00:44.913Z",
        "dateUpdated": "2026-05-11T21:32:05.569Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-05-11T21:32:05.569Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: add a retry logic in net6_rt_notify()\n\ninet6_rt_notify() can be called under RCU protection only.\nThis means the route could be changed concurrently\nand rt6_fill_node() could return -EMSGSIZE.\n\nRe-size the skb when this happens and retry, removing\none WARN_ON() that syzbot was able to trigger:\n\nWARNING: CPU: 3 PID: 6291 at net/ipv6/route.c:6342 inet6_rt_notify+0x475/0x4b0 net/ipv6/route.c:6342\nModules linked in:\nCPU: 3 UID: 0 PID: 6291 Comm: syz.0.77 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\n RIP: 0010:inet6_rt_notify+0x475/0x4b0 net/ipv6/route.c:6342\nCode: fc ff ff e8 6d 52 ea f7 e9 47 fc ff ff 48 8b 7c 24 08 4c 89 04 24 e8 5a 52 ea f7 4c 8b 04 24 e9 94 fd ff ff e8 9c fe 84 f7 90 <0f> 0b 90 e9 bd fd ff ff e8 6e 52 ea f7 e9 bb fb ff ff 48 89 df e8\nRSP: 0018:ffffc900035cf1d8 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffc900035cf540 RCX: ffffffff8a36e790\nRDX: ffff88802f7e8000 RSI: ffffffff8a36e9d4 RDI: 0000000000000005\nRBP: ffff88803c230f00 R08: 0000000000000005 R09: 00000000ffffffa6\nR10: 00000000ffffffa6 R11: 0000000000000001 R12: 00000000ffffffa6\nR13: 0000000000000900 R14: ffff888032ea4100 R15: 0000000000000000\nFS:  00007fac7b89a6c0(0000) GS:ffff8880d6a20000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fac7b899f98 CR3: 0000000034b3f000 CR4: 0000000000352ef0\nCall Trace:\n <TASK>\n  ip6_route_mpath_notify+0xde/0x280 net/ipv6/route.c:5356\n  ip6_route_multipath_add+0x1181/0x1bd0 net/ipv6/route.c:5536\n  inet6_rtm_newroute+0xe4/0x1a0 net/ipv6/route.c:5647\n  rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:6944\n  netlink_rcv_skb+0x155/0x420 net/netlink/af_netlink.c:2552\n  netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n  netlink_unicast+0x58d/0x850 net/netlink/af_netlink.c:1346\n  netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896\n  sock_sendmsg_nosec net/socket.c:712 [inline]\n  __sock_sendmsg net/socket.c:727 [inline]\n  ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566\n  ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620"
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "net/ipv6/route.c"
                    ],
                    "versions": [
                        {
                            "version": "169fd62799e8acabbfb4760799be11138ced949c",
                            "lessThan": "0bdca3439a22c70eb8f404acd61bf7aca5d731b0",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "169fd62799e8acabbfb4760799be11138ced949c",
                            "lessThan": "ea2f921db7a483a526058c5b5b8162edd88dabe5",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "net/ipv6/route.c"
                    ],
                    "versions": [
                        {
                            "version": "6.16",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.16",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.16.1",
                            "lessThanOrEqual": "6.16.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.17",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.16",
                                    "versionEndExcluding": "6.16.1"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.16",
                                    "versionEndExcluding": "6.17"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/0bdca3439a22c70eb8f404acd61bf7aca5d731b0"
                },
                {
                    "url": "https://git.kernel.org/stable/c/ea2f921db7a483a526058c5b5b8162edd88dabe5"
                }
            ],
            "title": "ipv6: add a retry logic in net6_rt_notify()",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}