CVE-2025-38524

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38524", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.023Z", "datePublished": "2025-08-16T11:12:18.314Z", "dateUpdated": "2026-10-30T12:22:00.883Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:22:00.883Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix recv-recv race of completed call\n\nIf a call receives an event (such as incoming data), the call gets placed\non the socket's queue and a thread in recvmsg can be awakened to go and\nprocess it. Once the thread has picked up the call off of the queue,\nfurther events will cause it to be requeued, and once the socket lock is\ndropped (recvmsg uses call->user_mutex to allow the socket to be used in\nparallel), a second thread can come in and its recvmsg can pop the call off\nthe socket queue again.\n\nIn such a case, the first thread will be receiving stuff from the call and\nthe second thread will be blocked on call->user_mutex. The first thread\ncan, at this point, process both the event that it picked call for and the\nevent that the second thread picked the call for and may see the call\nterminate - in which case the call will be \"released\", decoupling the call\nfrom the user call ID assigned to it (RXRPC_USER_CALL_ID in the control\nmessage).\n\nThe first thread will return okay, but then the second thread will wake up\nholding the user_mutex and, if it sees that the call has been released by\nthe first thread, it will BUG thusly:\n\n\tkernel BUG at net/rxrpc/recvmsg.c:474!\n\nFix this by just dequeuing the call and ignoring it if it is seen to be\nalready released. We can't tell userspace about it anyway as the user call\nID has become stale."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The race is driven entirely by received rxrpc/UDP packets processed in net/rxrpc \u2014 DATA packets re-queue the call via rxrpc_notify_socket() and an ABORT packet completes it via rxrpc_input_abort(). A remote peer talking to a userspace AF_RXRPC service socket (the documented one-socket-per-service model, serviced by a worker thread pool) supplies every event needed.\nAC:L - The attacker controls the entire packet stream that creates both sides of the race \u2014 the extra DATA notification that re-queues the call and the ABORT that terminates it \u2014 and can retry indefinitely at high rate with no precondition outside their influence. In the local variant the attacker owns both recvmsg threads and both socket endpoints outright.\nPR:N - No capability check exists anywhere in net/rxrpc, and the DATA/ABORT packets that drive the race are handled by the rxrpc transport layer before any rxkad/rxgk or application-level credential verification. A completely unauthenticated remote peer can issue a call and abort it.\nUI:N - No victim action is required; the packets are consumed automatically by the kernel's rxrpc input path and the already-running service threads.\nS:U - The BUG() fires in the kernel and its effect is confined to that kernel's own security authority, with no crossing into a hypervisor, IOMMU, or other boundary.\nC:N - This is an unconditional assertion failure on a still-valid, still-refcounted call object \u2014 there is no out-of-bounds read, no use-after-free, and no data copied to userspace, so nothing is disclosed.\nI:N - No memory is written out of bounds and no kernel state is corrupted; the call structure remains intact and correctly referenced, so there is no modification primitive.\nA:H - BUG() executes ud2, producing a kernel oops that kills the thread \u2014 and a full panic/reboot on the many deployments running panic_on_oops. The dying thread also leaves call->user_mutex permanently locked and leaks call/socket references, hanging every other thread on that socket, and the attacker can repeat it at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/call_accept.c", "net/rxrpc/recvmsg.c"], "versions": [{"version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "4aed0eeca58e26d752bb08b293b8dc75c6820b23", "status": "affected", "versionType": "git"}, {"version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "cb720b068b18fb39c96980eb3c13f09427512be7", "status": "affected", "versionType": "git"}, {"version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "7692bde890061797f3dece0148d7859e85c55778", "status": "affected", "versionType": "git"}, {"version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "839fe96c15209dc2255c064bb44b636efe04f032", "status": "affected", "versionType": "git"}, {"version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "6c75a97a32a5fa2060c3dd30207e63b6914b606d", "status": "affected", "versionType": "git"}, {"version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/call_accept.c", "net/rxrpc/recvmsg.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.266", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.100", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.40", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.8", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.10.266"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.100"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.12.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.15.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4aed0eeca58e26d752bb08b293b8dc75c6820b23"}, {"url": "https://git.kernel.org/stable/c/cb720b068b18fb39c96980eb3c13f09427512be7"}, {"url": "https://git.kernel.org/stable/c/7692bde890061797f3dece0148d7859e85c55778"}, {"url": "https://git.kernel.org/stable/c/839fe96c15209dc2255c064bb44b636efe04f032"}, {"url": "https://git.kernel.org/stable/c/6c75a97a32a5fa2060c3dd30207e63b6914b606d"}, {"url": "https://git.kernel.org/stable/c/962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc"}], "title": "rxrpc: Fix recv-recv race of completed call", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38524", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:51:20.750343Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:18.441Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38524", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:51:20.750343Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:51:21.715Z"}}], "cna": {"title": "rxrpc: Fix recv-recv race of completed call", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The race is driven entirely by received rxrpc/UDP packets processed in net/rxrpc \u2014 DATA packets re-queue the call via rxrpc_notify_socket() and an ABORT packet completes it via rxrpc_input_abort(). A remote peer talking to a userspace AF_RXRPC service socket (the documented one-socket-per-service model, serviced by a worker thread pool) supplies every event needed.\nAC:L - The attacker controls the entire packet stream that creates both sides of the race \u2014 the extra DATA notification that re-queues the call and the ABORT that terminates it \u2014 and can retry indefinitely at high rate with no precondition outside their influence. In the local variant the attacker owns both recvmsg threads and both socket endpoints outright.\nPR:N - No capability check exists anywhere in net/rxrpc, and the DATA/ABORT packets that drive the race are handled by the rxrpc transport layer before any rxkad/rxgk or application-level credential verification. A completely unauthenticated remote peer can issue a call and abort it.\nUI:N - No victim action is required; the packets are consumed automatically by the kernel's rxrpc input path and the already-running service threads.\nS:U - The BUG() fires in the kernel and its effect is confined to that kernel's own security authority, with no crossing into a hypervisor, IOMMU, or other boundary.\nC:N - This is an unconditional assertion failure on a still-valid, still-refcounted call object \u2014 there is no out-of-bounds read, no use-after-free, and no data copied to userspace, so nothing is disclosed.\nI:N - No memory is written out of bounds and no kernel state is corrupted; the call structure remains intact and correctly referenced, so there is no modification primitive.\nA:H - BUG() executes ud2, producing a kernel oops that kills the thread \u2014 and a full panic/reboot on the many deployments running panic_on_oops. The dying thread also leaves call->user_mutex permanently locked and leaks call/socket references, hanging every other thread on that socket, and the attacker can repeat it at will."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "4aed0eeca58e26d752bb08b293b8dc75c6820b23", "versionType": "git"}, {"status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "cb720b068b18fb39c96980eb3c13f09427512be7", "versionType": "git"}, {"status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "7692bde890061797f3dece0148d7859e85c55778", "versionType": "git"}, {"status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "839fe96c15209dc2255c064bb44b636efe04f032", "versionType": "git"}, {"status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "6c75a97a32a5fa2060c3dd30207e63b6914b606d", "versionType": "git"}, {"status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc", "versionType": "git"}], "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/call_accept.c", "net/rxrpc/recvmsg.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"status": "unaffected", "version": "0", "lessThan": "4.9", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.266", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.100", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.40", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.8", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/call_accept.c", "net/rxrpc/recvmsg.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/4aed0eeca58e26d752bb08b293b8dc75c6820b23"}, {"url": "https://git.kernel.org/stable/c/cb720b068b18fb39c96980eb3c13f09427512be7"}, {"url": "https://git.kernel.org/stable/c/7692bde890061797f3dece0148d7859e85c55778"}, {"url": "https://git.kernel.org/stable/c/839fe96c15209dc2255c064bb44b636efe04f032"}, {"url": "https://git.kernel.org/stable/c/6c75a97a32a5fa2060c3dd30207e63b6914b606d"}, {"url": "https://git.kernel.org/stable/c/962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix recv-recv race of completed call\n\nIf a call receives an event (such as incoming data), the call gets placed\non the socket's queue and a thread in recvmsg can be awakened to go and\nprocess it. Once the thread has picked up the call off of the queue,\nfurther events will cause it to be requeued, and once the socket lock is\ndropped (recvmsg uses call->user_mutex to allow the socket to be used in\nparallel), a second thread can come in and its recvmsg can pop the call off\nthe socket queue again.\n\nIn such a case, the first thread will be receiving stuff from the call and\nthe second thread will be blocked on call->user_mutex. The first thread\ncan, at this point, process both the event that it picked call for and the\nevent that the second thread picked the call for and may see the call\nterminate - in which case the call will be \"released\", decoupling the call\nfrom the user call ID assigned to it (RXRPC_USER_CALL_ID in the control\nmessage).\n\nThe first thread will return okay, but then the second thread will wake up\nholding the user_mutex and, if it sees that the call has been released by\nthe first thread, it will BUG thusly:\n\n\tkernel BUG at net/rxrpc/recvmsg.c:474!\n\nFix this by just dequeuing the call and ignoring it if it is seen to be\nalready released. We can't tell userspace about it anyway as the user call\nID has become stale."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.266", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.100", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.40", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.8", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16", "versionStartIncluding": "4.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:22:00.883Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38524", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:22:00.883Z", "dateReserved": "2025-04-16T04:51:24.023Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-08-16T11:12:18.314Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/call_accept.c", "net/rxrpc/recvmsg.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4aed0eeca58e26d752bb08b293b8dc75c6820b23", "status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "versionType": "git"}, {"lessThan": "cb720b068b18fb39c96980eb3c13f09427512be7", "status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "versionType": "git"}, {"lessThan": "7692bde890061797f3dece0148d7859e85c55778", "status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "versionType": "git"}, {"lessThan": "839fe96c15209dc2255c064bb44b636efe04f032", "status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "versionType": "git"}, {"lessThan": "6c75a97a32a5fa2060c3dd30207e63b6914b606d", "status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "versionType": "git"}, {"lessThan": "962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc", "status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/call_accept.c", "net/rxrpc/recvmsg.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.266", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.100", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.40", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5B60D16D-727D-40AD-91FE-5272637AE855", "versionEndExcluding": "6.6.100", "versionStartIncluding": "4.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0099D5A4-B157-4D36-8858-982C7D579030", "versionEndExcluding": "6.12.40", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C7AFE5B0-F3B1-4D30-B8BF-EDA0385C4746", "versionEndExcluding": "6.15.8", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*", "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*", "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*", "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*", "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*", "matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*", "matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix recv-recv race of completed call\n\nIf a call receives an event (such as incoming data), the call gets placed\non the socket's queue and a thread in recvmsg can be awakened to go and\nprocess it. Once the thread has picked up the call off of the queue,\nfurther events will cause it to be requeued, and once the socket lock is\ndropped (recvmsg uses call->user_mutex to allow the socket to be used in\nparallel), a second thread can come in and its recvmsg can pop the call off\nthe socket queue again.\n\nIn such a case, the first thread will be receiving stuff from the call and\nthe second thread will be blocked on call->user_mutex. The first thread\ncan, at this point, process both the event that it picked call for and the\nevent that the second thread picked the call for and may see the call\nterminate - in which case the call will be \"released\", decoupling the call\nfrom the user call ID assigned to it (RXRPC_USER_CALL_ID in the control\nmessage).\n\nThe first thread will return okay, but then the second thread will wake up\nholding the user_mutex and, if it sees that the call has been released by\nthe first thread, it will BUG thusly:\n\n\tkernel BUG at net/rxrpc/recvmsg.c:474!\n\nFix this by just dequeuing the call and ignoring it if it is seen to be\nalready released. We can't tell userspace about it anyway as the user call\nID has become stale."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rxrpc: Corregir la ejecuci\u00f3n recv-recv de la llamada completada. Si una llamada recibe un evento (como datos entrantes), la llamada se coloca en la cola del socket y se puede despertar un hilo en recvmsg para que la procese. Una vez que el hilo ha recogido la llamada de la cola, eventos posteriores har\u00e1n que se vuelva a poner en cola, y una vez que se libera el bloqueo del socket (recvmsg usa call->user_mutex para permitir que el socket se use en paralelo), un segundo hilo puede entrar y su recvmsg puede sacar la llamada de la cola del socket nuevamente. En tal caso, el primer hilo recibir\u00e1 cosas de la llamada y el segundo hilo se bloquear\u00e1 en call->user_mutex. En este punto, el primer hilo puede procesar tanto el evento para el que seleccion\u00f3 la llamada como el evento para el que el segundo hilo la seleccion\u00f3, y podr\u00eda ver que la llamada termina. En ese caso, la llamada se \"liberar\u00e1\", desvincul\u00e1ndola del ID de llamada de usuario que se le asign\u00f3 (RXRPC_USER_CALL_ID en el mensaje de control). El primer hilo retornar\u00e1 correctamente, pero el segundo hilo se reactivar\u00e1 con el user_mutex y, si detecta que el primer hilo ha liberado la llamada, generar\u00e1 el siguiente error: \u00a1error del kernel en net/rxrpc/recvmsg.c:474! Para solucionar esto, simplemente retire la llamada de la cola e ignore si ya est\u00e1 liberada. De todos modos, no podemos informar al espacio de usuario, ya que el ID de llamada de usuario ha quedado obsoleto."}], "id": "CVE-2025-38524", "lastModified": "2026-10-30T13:18:05.443", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38524", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:51:20.750343Z", "version": "2.0.3"}}]}, "published": "2025-08-16T12:15:27.800", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4aed0eeca58e26d752bb08b293b8dc75c6820b23"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6c75a97a32a5fa2060c3dd30207e63b6914b606d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7692bde890061797f3dece0148d7859e85c55778"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/839fe96c15209dc2255c064bb44b636efe04f032"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cb720b068b18fb39c96980eb3c13f09427512be7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: rxrpc: Fix recv-recv race of completed call", "id": "2388925", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2388925"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nrxrpc: Fix recv-recv race of completed call\nIf a call receives an event (such as incoming data), the call gets placed\non the socket's queue and a thread in recvmsg can be awakened to go and\nprocess it. Once the thread has picked up the call off of the queue,\nfurther events will cause it to be requeued, and once the socket lock is\ndropped (recvmsg uses call->user_mutex to allow the socket to be used in\nparallel), a second thread can come in and its recvmsg can pop the call off\nthe socket queue again.\nIn such a case, the first thread will be receiving stuff from the call and\nthe second thread will be blocked on call->user_mutex. The first thread\ncan, at this point, process both the event that it picked call for and the\nevent that the second thread picked the call for and may see the call\nterminate - in which case the call will be \"released\", decoupling the call\nfrom the user call ID assigned to it (RXRPC_USER_CALL_ID in the control\nmessage).\nThe first thread will return okay, but then the second thread will wake up\nholding the user_mutex and, if it sees that the call has been released by\nthe first thread, it will BUG thusly:\nkernel BUG at net/rxrpc/recvmsg.c:474!\nFix this by just dequeuing the call and ignoring it if it is seen to be\nalready released. We can't tell userspace about it anyway as the user call\nID has become stale."], "name": "CVE-2025-38524", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-08-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38524\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38524\nhttps://lore.kernel.org/linux-cve-announce/2025081653-CVE-2025-38524-7277@gregkh/T"], "threat_severity": "Important"}

{"created": "2025-08-18T20:50:06.508419+00:00", "updated": "2025-08-18T20:50:06.508549+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}