CVE-2025-38717 — Race Condition in Linux

CWE-362 — Race Condition6 documents6 sources
Severity
4.7MEDIUMNVD
EPSS
0.0%
top 97.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
16
LinuxLinux KernelDebian Linux+13 more
Timeline
PublishedSep 4
Latest updateSep 9

Description

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Fix race condition in kcm_unattach() syzbot found a race condition when kcm_unattach(psock) and kcm_release(kcm) are executed at the same time. kcm_unattach() is missing a check of the flag kcm->tx_stopped before calling queue_work(). If the kcm has a reserved psock, kcm_unattach() might get executed between cancel_work_sync() and unreserve_psock() in kcm_release(), requeuing kcm->tx_work right before kcm gets free…

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.0 | Impact: 3.6

Affected Packages17 packages

▶NVDlinux/linux_kernel4.6 — 6.12.43+3
▶Debianlinux/linux_kernel< 6.12.43-1+1

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-998f-8276-5gr2: In the Linux kernel, the following vulnerability has been resolved: net: kcm: Fix race condition in kcm_unattach() syzbot found a race condition whe↗2025-09-05
▶
OSV
CVE-2025-38717: In the Linux kernel, the following vulnerability has been resolved: net: kcm: Fix race condition in kcm_unattach() syzbot found a race condition when↗2025-09-04
▶

📋Vendor Advisories

3
Microsoft
net: kcm: Fix race condition in kcm_unattach()↗2025-09-09
▶
Red Hat
kernel: net: kcm: Fix race condition in kcm_unattach()↗2025-09-04
▶
Debian
CVE-2025-38717: linux - In the Linux kernel, the following vulnerability has been resolved: net: kcm: F...↗2025
▶