Look up another CVE · open CVE-2025-38524 in the interactive tracker
CVE-2025-38524
rxrpc: Fix recv-recv race of completed call
Published 2025-08-16 (14 months ago) by the Linux kernel CNA. Subsystem include/trace. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2025-38524 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.12.41-1 | Update the kernel and reboot. Fixed in 6.12.41-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 6.16.3-1 | Update the kernel and reboot. Fixed in 6.16.3-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.16.3-1 | Update the kernel and reboot. Fixed in 6.16.3-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
If a call receives an event (such as incoming data), the call gets placed on the socket's queue and a thread in recvmsg can be awakened to go and process it. Once the thread has picked up the call off of the queue, further events will cause it to be requeued, and once the socket lock is dropped (recvmsg uses call->user_mutex to allow the socket to be used in parallel), a second thread can come in and its recvmsg can pop the call off the socket queue again. In such a case, the first thread will be receiving stuff from the call and the second thread will be blocked on call->user_mutex. The first thread can, at this point, process both the event that it picked call for and the event that the second thread picked the call for and may see the call terminate - in which case the call will be "released", decoupling the call from the user call ID assigned to it (RXRPC_USER_CALL_ID in the control message). The first thread will return okay, but then the second thread will wake up holding the user_mutex and, if it sees that the call has been released by the first thread, it will BUG thusly: kernel BUG at net/rxrpc/recvmsg.c:474! Fix this by just dequeuing the call and ignoring it if it is seen to be already released. We can't tell userspace about it anyway as the user call ID has become stale.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
include/trace/events/rxrpc.h
net/rxrpc/call_accept.c
net/rxrpc/recvmsg.c
- What this is
- RXRPC SOCKETS (AF_RXRPC)MAINTAINERS section matched on include/trace/events/rxrpc.h · linux-afs@lists.infradead.org · Supported
- Kernel module
- rxrpc
Check it on the machine
grep -w CONFIG_AF_RXRPC /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w rxrpcPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookworm, trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_AF_RXRPC
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2025-08-16 (14 months ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.27%, higher than 18.5% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- include/trace
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.9 | 5.10.266 | 4aed0eeca58e |
| 4.9 | 6.6.100 | 7692bde89006 |
| 4.9 | 6.12.40 | 839fe96c1520 |
| 4.9 | 6.15.8 | 6c75a97a32a5 |
| 4.9 | 6.16 | 962fb1f651c2 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The race is driven entirely by received rxrpc/UDP packets processed in net/rxrpc — DATA packets re-queue the call via rxrpc_notify_socket() and an ABORT packet completes it via rxrpc_input_abort(). A remote peer talking to a userspace AF_RXRPC service socket (the documented one-socket-per-service model, serviced by a worker thread pool) supplies every event needed.
- AC:LAttack complexity, low
- The attacker controls the entire packet stream that creates both sides of the race — the extra DATA notification that re-queues the call and the ABORT that terminates it — and can retry indefinitely at high rate with no precondition outside their influence. In the local variant the attacker owns both recvmsg threads and both socket endpoints outright.
- PR:NPrivileges required, none
- No capability check exists anywhere in net/rxrpc, and the DATA/ABORT packets that drive the race are handled by the rxrpc transport layer before any rxkad/rxgk or application-level credential verification. A completely unauthenticated remote peer can issue a call and abort it.
- UI:NUser interaction, none
- No victim action is required; the packets are consumed automatically by the kernel's rxrpc input path and the already-running service threads.
- S:UScope, unchanged
- The BUG() fires in the kernel and its effect is confined to that kernel's own security authority, with no crossing into a hypervisor, IOMMU, or other boundary.
- C:NConfidentiality impact, none
- This is an unconditional assertion failure on a still-valid, still-refcounted call object — there is no out-of-bounds read, no use-after-free, and no data copied to userspace, so nothing is disclosed.
- I:NIntegrity impact, none
- No memory is written out of bounds and no kernel state is corrupted; the call structure remains intact and correctly referenced, so there is no modification primitive.
- A:HAvailability impact, high
- BUG() executes ud2, producing a kernel oops that kills the thread — and a full panic/reboot on the many deployments running panic_on_oops. The dying thread also leaves call->user_mutex permanently locked and leaks call/socket references, hanging every other thread on that socket, and the attacker can repeat it at will.