CVE-2025-38638

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38638", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.030Z", "datePublished": "2025-08-22T16:00:44.913Z", "dateUpdated": "2026-05-11T21:32:05.569Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:32:05.569Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: add a retry logic in net6_rt_notify()\n\ninet6_rt_notify() can be called under RCU protection only.\nThis means the route could be changed concurrently\nand rt6_fill_node() could return -EMSGSIZE.\n\nRe-size the skb when this happens and retry, removing\none WARN_ON() that syzbot was able to trigger:\n\nWARNING: CPU: 3 PID: 6291 at net/ipv6/route.c:6342 inet6_rt_notify+0x475/0x4b0 net/ipv6/route.c:6342\nModules linked in:\nCPU: 3 UID: 0 PID: 6291 Comm: syz.0.77 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\n RIP: 0010:inet6_rt_notify+0x475/0x4b0 net/ipv6/route.c:6342\nCode: fc ff ff e8 6d 52 ea f7 e9 47 fc ff ff 48 8b 7c 24 08 4c 89 04 24 e8 5a 52 ea f7 4c 8b 04 24 e9 94 fd ff ff e8 9c fe 84 f7 90 <0f> 0b 90 e9 bd fd ff ff e8 6e 52 ea f7 e9 bb fb ff ff 48 89 df e8\nRSP: 0018:ffffc900035cf1d8 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffc900035cf540 RCX: ffffffff8a36e790\nRDX: ffff88802f7e8000 RSI: ffffffff8a36e9d4 RDI: 0000000000000005\nRBP: ffff88803c230f00 R08: 0000000000000005 R09: 00000000ffffffa6\nR10: 00000000ffffffa6 R11: 0000000000000001 R12: 00000000ffffffa6\nR13: 0000000000000900 R14: ffff888032ea4100 R15: 0000000000000000\nFS: 00007fac7b89a6c0(0000) GS:ffff8880d6a20000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fac7b899f98 CR3: 0000000034b3f000 CR4: 0000000000352ef0\nCall Trace:\n <TASK>\n ip6_route_mpath_notify+0xde/0x280 net/ipv6/route.c:5356\n ip6_route_multipath_add+0x1181/0x1bd0 net/ipv6/route.c:5536\n inet6_rtm_newroute+0xe4/0x1a0 net/ipv6/route.c:5647\n rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:6944\n netlink_rcv_skb+0x155/0x420 net/netlink/af_netlink.c:2552\n netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n netlink_unicast+0x58d/0x850 net/netlink/af_netlink.c:1346\n netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg net/socket.c:727 [inline]\n ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566\n ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/route.c"], "versions": [{"version": "169fd62799e8acabbfb4760799be11138ced949c", "lessThan": "0bdca3439a22c70eb8f404acd61bf7aca5d731b0", "status": "affected", "versionType": "git"}, {"version": "169fd62799e8acabbfb4760799be11138ced949c", "lessThan": "ea2f921db7a483a526058c5b5b8162edd88dabe5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/route.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.1", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.16.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0bdca3439a22c70eb8f404acd61bf7aca5d731b0"}, {"url": "https://git.kernel.org/stable/c/ea2f921db7a483a526058c5b5b8162edd88dabe5"}], "title": "ipv6: add a retry logic in net6_rt_notify()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv6/route.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0bdca3439a22c70eb8f404acd61bf7aca5d731b0", "status": "affected", "version": "169fd62799e8acabbfb4760799be11138ced949c", "versionType": "git"}, {"lessThan": "ea2f921db7a483a526058c5b5b8162edd88dabe5", "status": "affected", "version": "169fd62799e8acabbfb4760799be11138ced949c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv6/route.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:*:*:*:*:*:*:*", "matchCriteriaId": "D6BFC4F7-7099-4420-AF39-DD1CEABB8DF9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: add a retry logic in net6_rt_notify()\n\ninet6_rt_notify() can be called under RCU protection only.\nThis means the route could be changed concurrently\nand rt6_fill_node() could return -EMSGSIZE.\n\nRe-size the skb when this happens and retry, removing\none WARN_ON() that syzbot was able to trigger:\n\nWARNING: CPU: 3 PID: 6291 at net/ipv6/route.c:6342 inet6_rt_notify+0x475/0x4b0 net/ipv6/route.c:6342\nModules linked in:\nCPU: 3 UID: 0 PID: 6291 Comm: syz.0.77 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\n RIP: 0010:inet6_rt_notify+0x475/0x4b0 net/ipv6/route.c:6342\nCode: fc ff ff e8 6d 52 ea f7 e9 47 fc ff ff 48 8b 7c 24 08 4c 89 04 24 e8 5a 52 ea f7 4c 8b 04 24 e9 94 fd ff ff e8 9c fe 84 f7 90 <0f> 0b 90 e9 bd fd ff ff e8 6e 52 ea f7 e9 bb fb ff ff 48 89 df e8\nRSP: 0018:ffffc900035cf1d8 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffc900035cf540 RCX: ffffffff8a36e790\nRDX: ffff88802f7e8000 RSI: ffffffff8a36e9d4 RDI: 0000000000000005\nRBP: ffff88803c230f00 R08: 0000000000000005 R09: 00000000ffffffa6\nR10: 00000000ffffffa6 R11: 0000000000000001 R12: 00000000ffffffa6\nR13: 0000000000000900 R14: ffff888032ea4100 R15: 0000000000000000\nFS: 00007fac7b89a6c0(0000) GS:ffff8880d6a20000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fac7b899f98 CR3: 0000000034b3f000 CR4: 0000000000352ef0\nCall Trace:\n <TASK>\n ip6_route_mpath_notify+0xde/0x280 net/ipv6/route.c:5356\n ip6_route_multipath_add+0x1181/0x1bd0 net/ipv6/route.c:5536\n inet6_rtm_newroute+0xe4/0x1a0 net/ipv6/route.c:5647\n rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:6944\n netlink_rcv_skb+0x155/0x420 net/netlink/af_netlink.c:2552\n netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n netlink_unicast+0x58d/0x850 net/netlink/af_netlink.c:1346\n netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg net/socket.c:727 [inline]\n ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566\n ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ipv6: a\u00f1adir una l\u00f3gica de reintento en net6_rt_notify(). inet6_rt_notify() solo se puede ejecutar bajo la protecci\u00f3n de RCU. Esto significa que la ruta podr\u00eda modificarse simult\u00e1neamente y que rt6_fill_node() podr\u00eda devolver -EMSGSIZE. Redimensione el skb cuando esto suceda y vuelva a intentarlo, eliminando un WARN_ON() que syzbot pudo activar: WARNING: CPU: 3 PID: 6291 at net/ipv6/route.c:6342 inet6_rt_notify+0x475/0x4b0 net/ipv6/route.c:6342 Modules linked in: CPU: 3 UID: 0 PID: 6291 Comm: syz.0.77 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:inet6_rt_notify+0x475/0x4b0 net/ipv6/route.c:6342 Code: fc ff ff e8 6d 52 ea f7 e9 47 fc ff ff 48 8b 7c 24 08 4c 89 04 24 e8 5a 52 ea f7 4c 8b 04 24 e9 94 fd ff ff e8 9c fe 84 f7 90 &lt;0f&gt; 0b 90 e9 bd fd ff ff e8 6e 52 ea f7 e9 bb fb ff ff 48 89 df e8 RSP: 0018:ffffc900035cf1d8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffc900035cf540 RCX: ffffffff8a36e790 RDX: ffff88802f7e8000 RSI: ffffffff8a36e9d4 RDI: 0000000000000005 RBP: ffff88803c230f00 R08: 0000000000000005 R09: 00000000ffffffa6 R10: 00000000ffffffa6 R11: 0000000000000001 R12: 00000000ffffffa6 R13: 0000000000000900 R14: ffff888032ea4100 R15: 0000000000000000 FS: 00007fac7b89a6c0(0000) GS:ffff8880d6a20000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fac7b899f98 CR3: 0000000034b3f000 CR4: 0000000000352ef0 Call Trace: ip6_route_mpath_notify+0xde/0x280 net/ipv6/route.c:5356 ip6_route_multipath_add+0x1181/0x1bd0 net/ipv6/route.c:5536 inet6_rtm_newroute+0xe4/0x1a0 net/ipv6/route.c:5647 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:6944 netlink_rcv_skb+0x155/0x420 net/netlink/af_netlink.c:2552 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x58d/0x850 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg net/socket.c:727 [inline] ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620"}], "id": "CVE-2025-38638", "lastModified": "2026-06-17T09:17:16.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-08-22T16:15:37.713", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0bdca3439a22c70eb8f404acd61bf7aca5d731b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ea2f921db7a483a526058c5b5b8162edd88dabe5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ipv6: add a retry logic in net6_rt_notify()", "id": "2390362", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2390362"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nipv6: add a retry logic in net6_rt_notify()\ninet6_rt_notify() can be called under RCU protection only.\nThis means the route could be changed concurrently\nand rt6_fill_node() could return -EMSGSIZE.\nRe-size the skb when this happens and retry, removing\none WARN_ON() that syzbot was able to trigger:\nWARNING: CPU: 3 PID: 6291 at net/ipv6/route.c:6342 inet6_rt_notify+0x475/0x4b0 net/ipv6/route.c:6342\nModules linked in:\nCPU: 3 UID: 0 PID: 6291 Comm: syz.0.77 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:inet6_rt_notify+0x475/0x4b0 net/ipv6/route.c:6342\nCode: fc ff ff e8 6d 52 ea f7 e9 47 fc ff ff 48 8b 7c 24 08 4c 89 04 24 e8 5a 52 ea f7 4c 8b 04 24 e9 94 fd ff ff e8 9c fe 84 f7 90 <0f> 0b 90 e9 bd fd ff ff e8 6e 52 ea f7 e9 bb fb ff ff 48 89 df e8\nRSP: 0018:ffffc900035cf1d8 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffc900035cf540 RCX: ffffffff8a36e790\nRDX: ffff88802f7e8000 RSI: ffffffff8a36e9d4 RDI: 0000000000000005\nRBP: ffff88803c230f00 R08: 0000000000000005 R09: 00000000ffffffa6\nR10: 00000000ffffffa6 R11: 0000000000000001 R12: 00000000ffffffa6\nR13: 0000000000000900 R14: ffff888032ea4100 R15: 0000000000000000\nFS: 00007fac7b89a6c0(0000) GS:ffff8880d6a20000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fac7b899f98 CR3: 0000000034b3f000 CR4: 0000000000352ef0\nCall Trace:\n<TASK>\nip6_route_mpath_notify+0xde/0x280 net/ipv6/route.c:5356\nip6_route_multipath_add+0x1181/0x1bd0 net/ipv6/route.c:5536\ninet6_rtm_newroute+0xe4/0x1a0 net/ipv6/route.c:5647\nrtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:6944\nnetlink_rcv_skb+0x155/0x420 net/netlink/af_netlink.c:2552\nnetlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\nnetlink_unicast+0x58d/0x850 net/netlink/af_netlink.c:1346\nnetlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896\nsock_sendmsg_nosec net/socket.c:712 [inline]\n__sock_sendmsg net/socket.c:727 [inline]\n____sys_sendmsg+0xa95/0xc70 net/socket.c:2566\n___sys_sendmsg+0x134/0x1d0 net/socket.c:2620"], "name": "CVE-2025-38638", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38638\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38638\nhttps://lore.kernel.org/linux-cve-announce/2025082234-CVE-2025-38638-caad@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-08-23T10:55:15.961069+00:00", "updated": "2025-08-23T10:55:15.961151+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}