CVE-2025-38462

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38462
In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport_{g2h,h2g} TOCTOU vsock_find_cid() and vsock_dev_do_ioctl() may race with module unload. transport_{g2h,h2g} may become NULL after the NULL check. Introduce vsock_transport_local_cid() to protect from a potential null-ptr-deref. KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] RIP: 0010:vsock_find_cid+0x47/0x90 Call Trace: __vsock_bind+0x4b2/0x720 vsock_bind+0x90/0xe0 __sys_bind+0x14d/0x1e0 __x64_sys_bind+0x6e/0xc0 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] RIP: 0010:vsock_dev_do_ioctl.isra.0+0x58/0xf0 Call Trace: __x64_sys_ioctl+0x12d/0x190 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/209fd720838aaf1420416494c5505096478156b4 Patch
https://git.kernel.org/stable/c/3734d78210cceb2ee5615719a62a5c55ed381ff8 Patch
https://git.kernel.org/stable/c/401239811fa728fcdd53e360a91f157ffd23e1f4 Patch
https://git.kernel.org/stable/c/5752d8dbb3dfd7f1a9faf0f65377e60826ea9a17 Patch
https://git.kernel.org/stable/c/6a1bcab67bea797d83aa9dd948a0ac6ed52d121d Patch
https://git.kernel.org/stable/c/80d7dc15805a93d520a249ac6d13d4f4df161c1b Patch
https://git.kernel.org/stable/c/c5496ee685c48ed1cc183cd4263602579bb4a615 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

22 Dec 2025, 21:52

Type Values Removed Values Added
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/209fd720838aaf1420416494c5505096478156b4 - () https://git.kernel.org/stable/c/209fd720838aaf1420416494c5505096478156b4 - Patch
References () https://git.kernel.org/stable/c/3734d78210cceb2ee5615719a62a5c55ed381ff8 - () https://git.kernel.org/stable/c/3734d78210cceb2ee5615719a62a5c55ed381ff8 - Patch
References () https://git.kernel.org/stable/c/401239811fa728fcdd53e360a91f157ffd23e1f4 - () https://git.kernel.org/stable/c/401239811fa728fcdd53e360a91f157ffd23e1f4 - Patch
References () https://git.kernel.org/stable/c/5752d8dbb3dfd7f1a9faf0f65377e60826ea9a17 - () https://git.kernel.org/stable/c/5752d8dbb3dfd7f1a9faf0f65377e60826ea9a17 - Patch
References () https://git.kernel.org/stable/c/6a1bcab67bea797d83aa9dd948a0ac6ed52d121d - () https://git.kernel.org/stable/c/6a1bcab67bea797d83aa9dd948a0ac6ed52d121d - Patch
References () https://git.kernel.org/stable/c/80d7dc15805a93d520a249ac6d13d4f4df161c1b - () https://git.kernel.org/stable/c/80d7dc15805a93d520a249ac6d13d4f4df161c1b - Patch
References () https://git.kernel.org/stable/c/c5496ee685c48ed1cc183cd4263602579bb4a615 - () https://git.kernel.org/stable/c/c5496ee685c48ed1cc183cd4263602579bb4a615 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory
CWE CWE-367
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7

03 Nov 2025, 18:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

29 Jul 2025, 14:14

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vsock: Se ha corregido el error "TOCTOU" de transport_{g2h,h2g}. vsock_find_cid() y vsock_dev_do_ioctl() podrían competir con la descarga del módulo. transport_{g2h,h2g} podría volverse nulo después de la comprobación de valores nulos. Se ha implementado vsock_transport_local_cid() para proteger contra una posible desreferencia de PTR nula. KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] RIP: 0010:vsock_find_cid+0x47/0x90 Call Trace: __vsock_bind+0x4b2/0x720 vsock_bind+0x90/0xe0 __sys_bind+0x14d/0x1e0 __x64_sys_bind+0x6e/0xc0 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] RIP: 0010:vsock_dev_do_ioctl.isra.0+0x58/0xf0 Call Trace: __x64_sys_ioctl+0x12d/0x190 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53

25 Jul 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-25 16:15

Updated : 2025-12-22 21:52

NVD link : CVE-2025-38462

Mitre link : CVE-2025-38462

CVE.ORG link : CVE-2025-38462

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition