CVE-2025-38324 — Incorrect Synchronization in Linux
Severity
5.5MEDIUMNVD
OSV5.6OSV3.2
EPSS
0.0%
top 93.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 10
Latest updateMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
As syzbot reported [0], mpls_route_input_rcu() can be called
from mpls_getroute(), where is under RTNL.
net->mpls.platform_label is only updated under RTNL.
Let's use rcu_dereference_rtnl() in mpls_route_input_rcu() to
silence the splat.
[0]:
WARNING: suspicious RCU usage
6.15.0-rc7-syzkaller-00082-g5cdb2c77c4c3 #0 Not tainted
net/mpls/af_mpls.c:84 suspicious rcu_d…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages4 packages
▶CVEListV5linux/linux0189197f441602acdca3f97750d392a895b778fd — 2919297b18e5a5fb7e643f9e32c12c0b17cce1be+8
Also affects: Debian Linux 11.0