CVE-2025-38524rxrpc: Fix recv-recv race of completed call
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recv-recv race of completed call If a call receives an event (such as incoming data), the call gets placed on the socket's queue and a thread in recvmsg can be awakened to go and process it. Once the thread has picked up the call off of the queue, further events will cause it to be requeued, and once the socket lock is dropped (recvmsg uses call->user_mutex to allow the socket to be used in parallel), a second thread can come in and its recvmsg can pop the call off the socket queue again. In such a case, the first thread will be receiving stuff from the call and the second thread will be blocked on call->user_mutex. The first thread can, at this point, process both the event that it picked call for and the event that the second thread picked the call for and may see the call terminate - in which case the call will be "released", decoupling the call from the user call ID assigned to it (RXRPC_USER_CALL_ID in the control message). The first thread will return okay, but then the second thread will wake up holding the user_mutex and, if it sees that the call has been released by the first thread, it will BUG thusly: kernel BUG at net/rxrpc/recvmsg.c:474! Fix this by just dequeuing the call and ignoring it if it is seen to be already released. We can't tell userspace about it anyway as the user call ID has become stale.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | 248f219cb8bcbfbd7f132752d44afa2df7c241d1 builds before 4aed0eeca58e26d752bb08b293b8dc75c6820b23; from 248f219cb8bcbfbd7f132752d44afa2df7c241d1 before 7692bde890061797f3dece0148d7859e85c55778; from 248f219cb8bcbfbd7f132752d44afa2df7c241d1 before 839fe96c15209dc2255c064bb44b636efe04f032; 248f219cb8bcbfbd7f132752d44afa2df7c241d1 builds before 6c75a97a32a5fa2060c3dd30207e63b6914b606d; from 248f219cb8bcbfbd7f132752d44afa2df7c241d1 before 962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc | CNA record |
linux linux_kernel linux:linux_kernel | from 4.9 before 6.6.100; from 6.7 before 6.12.40; from 6.13 before 6.15.8; 6.16; 6.16; 6.16; 6.16; 6.16; and 1 more ranges | NVD |
References
- https://git.kernel.org/stable/c/4aed0eeca58e26d752bb08b293b8dc75c6820b23
- https://git.kernel.org/stable/c/7692bde890061797f3dece0148d7859e85c55778patch
- https://git.kernel.org/stable/c/839fe96c15209dc2255c064bb44b636efe04f032patch
- https://git.kernel.org/stable/c/6c75a97a32a5fa2060c3dd30207e63b6914b606dpatch
- https://git.kernel.org/stable/c/962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbcpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.