Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-38524— rxrpc: Fix recv-recv race of completed call

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于rxrpc在已完成调用上存在接收竞争，可能导致用户调用ID泄漏。

CVSS 7.5 · High EPSS 0.27% · P19

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 248f219cb8bcbfbd7f132752d44afa2df7c241d1< 4aed0eeca58e26d752bb08b293b8dc75c6820b23 affected
248f219cb8bcbfbd7f132752d44afa2df7c241d1< 7692bde890061797f3dece0148d7859e85c55778 affected
248f219cb8bcbfbd7f132752d44afa2df7c241d1< 839fe96c15209dc2255c064bb44b636efe04f032 affected
248f219cb8bcbfbd7f132752d44afa2df7c241d1< 6c75a97a32a5fa2060c3dd30207e63b6914b606d affected
248f219cb8bcbfbd7f132752d44afa2df7c241d1< 962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc affected
4.9 affected
< 4.9 unaffected
5.10.266≤ 5.10.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-38524

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
rxrpc: Fix recv-recv race of completed call
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recv-recv race of completed call If a call receives an event (such as incoming data), the call gets placed on the socket's queue and a thread in recvmsg can be awakened to go and process it. Once the thread has picked up the call off of the queue, further events will cause it to be requeued, and once the socket lock is dropped (recvmsg uses call->user_mutex to allow the socket to be used in parallel), a second thread can come in and its recvmsg can pop the call off the socket queue again. In such a case, the first thread will be receiving stuff from the call and the second thread will be blocked on call->user_mutex. The first thread can, at this point, process both the event that it picked call for and the event that the second thread picked the call for and may see the call terminate - in which case the call will be "released", decoupling the call from the user call ID assigned to it (RXRPC_USER_CALL_ID in the control message). The first thread will return okay, but then the second thread will wake up holding the user_mutex and, if it sees that the call has been released by the first thread, it will BUG thusly: kernel BUG at net/rxrpc/recvmsg.c:474! Fix this by just dequeuing the call and ignoring it if it is seen to be already released. We can't tell userspace about it anyway as the user call ID has become stale.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于rxrpc在已完成调用上存在接收竞争，可能导致用户调用ID泄漏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 248f219cb8bcbfbd7f132752d44afa2df7c241d1 ~ 4aed0eeca58e26d752bb08b293b8dc75c6820b23 -
Linux Linux 4.9 -

II. Public POCs for CVE-2025-38524

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-38524

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-38524 (5)

Same Patch Batch · Linux · 2025-08-16 · 59 CVEs total

CVE-2025-38533 9.8 CRITICAL net: libwx: fix the using of Rx buffer DMA
CVE-2025-38527 9.8 CRITICAL smb: client: fix use-after-free in cifs_oplock_break
CVE-2025-38552 9.4 CRITICAL mptcp: plug races between subflow fail and subflow creation
CVE-2023-3867 9.1 CRITICAL ksmbd: fix out of bounds read in smb2_sess_setup
CVE-2023-4515 9.1 CRITICAL ksmbd: validate command request size
CVE-2023-32249 9.1 CRITICAL ksmbd: not allow guest user on multichannel
CVE-2025-38512 8.8 HIGH wifi: prevent A-MSDU attacks in mesh networks
CVE-2025-38511 8.8 HIGH drm/xe/pf: Clear all LMTT pages on alloc
CVE-2023-4130 8.1 HIGH ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()
CVE-2023-3865 8.1 HIGH ksmbd: fix out-of-bound read in smb2_write
CVE-2025-38550 7.8 HIGH ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
CVE-2025-38502 7.8 HIGH bpf: Fix oob access in cgroup local storage
CVE-2025-38532 7.8 HIGH net: libwx: properly reset Rx ring descriptor
CVE-2025-38542 7.8 HIGH net: appletalk: Fix device refcount leak in atrtr_create()
CVE-2025-38536 7.8 HIGH net: airoha: fix potential use-after-free in airoha_npu_get()
CVE-2025-38539 7.8 HIGH tracing: Add down_write(trace_event_sem) when adding trace event
CVE-2025-38501 7.5 HIGH ksmbd: limit repeated connections from clients with the same IP
CVE-2025-38514 7.5 HIGH rxrpc: Fix oops due to non-existence of prealloc backlog struct
CVE-2025-38526 7.5 HIGH ice: add NULL check in eswitch lag check
CVE-2025-38523 7.5 HIGH cifs: Fix the smbd_response slab to allow usercopy

Showing top 20 of 59 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-38524

No comments yet

Leave a comment