GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38717 (GCVE-0-2025-38717)

Vulnerability from cvelistv5 – Published: 2025-09-04 15:33 – Updated: 2026-08-05 12:04
VLAI
Title
net: kcm: Fix race condition in kcm_unattach()
Summary
In the Linux kernel, the following vulnerability has been resolved: net: kcm: Fix race condition in kcm_unattach() syzbot found a race condition when kcm_unattach(psock) and kcm_release(kcm) are executed at the same time. kcm_unattach() is missing a check of the flag kcm->tx_stopped before calling queue_work(). If the kcm has a reserved psock, kcm_unattach() might get executed between cancel_work_sync() and unreserve_psock() in kcm_release(), requeuing kcm->tx_work right before kcm gets freed in kcm_done(). Remove kcm->tx_stopped and replace it by the less error-prone disable_work_sync().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 , < c0bffbc92a1ca3960fb9cdb8e9f75a68468eb308 (git)
Affected: ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 , < 7275dc3bb8f91b23125ff3f47b6529935cf46152 (git)
Affected: ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 , < 798733ee5d5788b12e8a52db1519abc17e826f69 (git)
Affected: ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 , < 52565a935213cd6a8662ddb8efe5b4219343a25d (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.6
Unaffected: 0 , < 4.6 (semver)
Unaffected: 6.12.43 , ≤ 6.12.* (semver)
Unaffected: 6.15.11 , ≤ 6.15.* (semver)
Unaffected: 6.16.2 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/kcm.h",
            "net/kcm/kcmsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c0bffbc92a1ca3960fb9cdb8e9f75a68468eb308",
              "status": "affected",
              "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
              "versionType": "git"
            },
            {
              "lessThan": "7275dc3bb8f91b23125ff3f47b6529935cf46152",
              "status": "affected",
              "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
              "versionType": "git"
            },
            {
              "lessThan": "798733ee5d5788b12e8a52db1519abc17e826f69",
              "status": "affected",
              "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
              "versionType": "git"
            },
            {
              "lessThan": "52565a935213cd6a8662ddb8efe5b4219343a25d",
              "status": "affected",
              "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/kcm.h",
            "net/kcm/kcmsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: kcm: Fix race condition in kcm_unattach()\n\nsyzbot found a race condition when kcm_unattach(psock)\nand kcm_release(kcm) are executed at the same time.\n\nkcm_unattach() is missing a check of the flag\nkcm-\u003etx_stopped before calling queue_work().\n\nIf the kcm has a reserved psock, kcm_unattach() might get executed\nbetween cancel_work_sync() and unreserve_psock() in kcm_release(),\nrequeuing kcm-\u003etx_work right before kcm gets freed in kcm_done().\n\nRemove kcm-\u003etx_stopped and replace it by the less\nerror-prone disable_work_sync()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is driven entirely by local syscalls \u2014 creating an AF_KCM socket, `SIOCKCMATTACH`/`SIOCKCMUNATTACH` ioctls, and `close()` \u2014 with no remote packet needed to reach the vulnerable window. No network-facing service parses attacker data on this path.\nAC:L - The attacker controls both sides of the race, running `kcm_release()` in one thread while a second thread issues `SIOCKCMUNATTACH` on the reserved psock, and can retry the loop indefinitely until the window between `cancel_work_sync()` and `unreserve_psock()` is hit. syzbot hit it repeatedly with three separate reproducers, and `CONFIG_AF_KCM` is shipped as a module by major distributions.\nPR:L - There is not a single `capable()` or `CAP_NET_ADMIN` check in `net/kcm/`, and the protocol family autoloads on an unprivileged `socket(AF_KCM, ...)` call via `MODULE_ALIAS_NETPROTO(PF_KCM)`. Any local unprivileged user can attach a TCP socket and trigger the race.\nUI:N - The attacker performs every step \u2014 socket creation, attach, unattach, and close \u2014 from its own threads. No victim action or cooperation is required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed `struct kcm_sock` is reachable from a workqueue and is reallocatable by the attacker (its own slab cache, refillable simply by creating more KCM sockets), so the UAF yields a read primitive over adjacent/reused kernel objects and can leak arbitrary kernel memory.\nI:H - Queueing work on a freed object makes the workqueue write into freed memory, and `kcm_tx_work()` subsequently operates on attacker-groomed contents, culminating in the indirect call `sk-\u003esk_write_space(sk)` in `kcm_write_msgs()` \u2014 a control-flow hijack / arbitrary-write path, not just corruption.\nA:H - Even unexploited, running `lock_sock()` and `kcm_write_msgs()` on a freed `kcm_sock` produces a KASAN-reported use-after-free, workqueue list corruption, and kernel oops/panic, which any unprivileged user can trigger repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:14.893Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c0bffbc92a1ca3960fb9cdb8e9f75a68468eb308"
        },
        {
          "url": "https://git.kernel.org/stable/c/7275dc3bb8f91b23125ff3f47b6529935cf46152"
        },
        {
          "url": "https://git.kernel.org/stable/c/798733ee5d5788b12e8a52db1519abc17e826f69"
        },
        {
          "url": "https://git.kernel.org/stable/c/52565a935213cd6a8662ddb8efe5b4219343a25d"
        }
      ],
      "title": "net: kcm: Fix race condition in kcm_unattach()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38717",
    "datePublished": "2025-09-04T15:33:11.686Z",
    "dateReserved": "2025-04-16T04:51:24.033Z",
    "dateUpdated": "2026-08-05T12:04:14.893Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38717",
      "date": "2026-09-18",
      "epss": "0.00114",
      "percentile": "0.01682"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-10T14:55:55.000Z",
      "cve": "CVE-2025-38717",
      "id": "msrc_CVE-2025-38717",
      "initial_release_date": "2025-09-06T01:12:47.000Z",
      "product_status:known_affected": "23",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: kcm: Fix race condition in kcm_unattach()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38717.json",
      "version": "18"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/kcm.h",
                  "net/kcm/kcmsock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c0bffbc92a1ca3960fb9cdb8e9f75a68468eb308",
                    "status": "affected",
                    "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7275dc3bb8f91b23125ff3f47b6529935cf46152",
                    "status": "affected",
                    "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "798733ee5d5788b12e8a52db1519abc17e826f69",
                    "status": "affected",
                    "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "52565a935213cd6a8662ddb8efe5b4219343a25d",
                    "status": "affected",
                    "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/kcm.h",
                  "net/kcm/kcmsock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.6"
                  },
                  {
                    "lessThan": "4.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.43",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.15.*",
                    "status": "unaffected",
                    "version": "6.15.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FE88E291-C7FB-45C2-9252-DC1DCF606A9F",
                    "versionEndExcluding": "6.12.43",
                    "versionStartIncluding": "4.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BC242347-F722-43AE-B910-BE0B22386977",
                    "versionEndExcluding": "6.15.11",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BD7C087D-2415-4521-B624-30003352F899",
                    "versionEndExcluding": "6.16.2",
                    "versionStartIncluding": "6.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: kcm: Fix race condition in kcm_unattach()\n\nsyzbot found a race condition when kcm_unattach(psock)\nand kcm_release(kcm) are executed at the same time.\n\nkcm_unattach() is missing a check of the flag\nkcm-\u003etx_stopped before calling queue_work().\n\nIf the kcm has a reserved psock, kcm_unattach() might get executed\nbetween cancel_work_sync() and unreserve_psock() in kcm_release(),\nrequeuing kcm-\u003etx_work right before kcm gets freed in kcm_done().\n\nRemove kcm-\u003etx_stopped and replace it by the less\nerror-prone disable_work_sync()."
          }
        ],
        "id": "CVE-2025-38717",
        "lastModified": "2026-07-30T06:23:36.737",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-09-04T16:15:41.257",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/52565a935213cd6a8662ddb8efe5b4219343a25d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7275dc3bb8f91b23125ff3f47b6529935cf46152"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/798733ee5d5788b12e8a52db1519abc17e826f69"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c0bffbc92a1ca3960fb9cdb8e9f75a68468eb308"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:22:10+00:00",
      "cve": "CVE-2025-38717",
      "id": "CVE-2025-38717",
      "initial_release_date": "2025-09-04T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: kcm: Fix race condition in kcm_unattach()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38717.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.