CVE-2025-38032: mr: consolidate the ipmr_can_free_table() checks.

Published Jun 18, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

mr: consolidate the ipmrcanfreetable() checks.

Guoyu Yin reported a splat in the ipmr netns cleanup path:

WARNING: CPU: 2 PID: 14564 at net/ipv4/ipmr.c:440 ipmrfreetable net/ipv4/ipmr.c:440 [inline] WARNING: CPU: 2 PID: 14564 at net/ipv4/ipmr.c:440 ipmrrulesexit+0x135/0x1c0 net/ipv4/ipmr.c:361 Modules linked in: CPU: 2 UID: 0 PID: 14564 Comm: syz.4.838 Not tainted 6.14.0 #1 Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:ipmrfreetable net/ipv4/ipmr.c:440 [inline] RIP: 0010:ipmrrulesexit+0x135/0x1c0 net/ipv4/ipmr.c:361 Code: ff df 48 c1 ea 03 80 3c 02 00 75 7d 48 c7 83 60 05 00 00 00 00 00 00 5b 5d 41 5c 41 5d 41 5e e9 71 67 7f 00 e8 4c 2d 8a fd 90 <0f> 0b 90 eb 93 e8 41 2d 8a fd 0f b6 2d 80 54 ea 01 31 ff 89 ee e8 RSP: 0018:ffff888109547c58 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff888108c12dc0 RCX: ffffffff83e09868 RDX: ffff8881022b3300 RSI: ffffffff83e098d4 RDI: 0000000000000005 RBP: ffff888104288000 R08: 0000000000000000 R09: ffffed10211825c9 R10: 0000000000000001 R11: ffff88801816c4a0 R12: 0000000000000001 R13: ffff888108c13320 R14: ffff888108c12dc0 R15: fffffbfff0b74058 FS: 00007f84f39316c0(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f84f3930f98 CR3: 0000000113b56000 CR4: 0000000000350ef0 Call Trace: <TASK> ipmrnetexitbatch+0x50/0x90 net/ipv4/ipmr.c:3160 opsexitlist+0x10c/0x160 net/core/netnamespace.c:177 setupnet+0x47d/0x8e0 net/core/netnamespace.c:394 copynetns+0x25d/0x410 net/core/netnamespace.c:516 createnewnamespaces+0x3f6/0xaf0 kernel/nsproxy.c:110 unsharensproxynamespaces+0xc3/0x180 kernel/nsproxy.c:228 ksysunshare+0x78d/0x9a0 kernel/fork.c:3342 dosysunshare kernel/fork.c:3413 [inline] sesysunshare kernel/fork.c:3411 [inline] x64sysunshare+0x31/0x40 kernel/fork.c:3411 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xa6/0x1a0 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f RIP: 0033:0x7f84f532cc29 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f84f3931038 EFLAGS: 00000246 ORIGRAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007f84f5615fa0 RCX: 00007f84f532cc29 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000400 RBP: 00007f84f53fba18 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f84f5615fa0 R15: 00007fff51c5f328 </TASK>

The running kernel has CONFIGIPMROUTEMULTIPLETABLES disabled, and the sanity check for such build is still too loose.

Address the issue consolidating the relevant sanity check in a single helper regardless of the kernel configuration. Also share it between the ipv4 and ipv6 code.

Affected Software

16 affected components
Linux Linux kernel
Linux Linux kernel>=6.13.1<6.14.9
Linux Linux kernel=6.13
Linux Linux kernel=6.13-rc2
Linux Linux kernel=6.13-rc3
Linux Linux kernel=6.13-rc4
Linux Linux kernel=6.13-rc5
Linux Linux kernel=6.13-rc6
Linux Linux kernel=6.13-rc7
Linux Linux kernel=6.15-rc1
Linux Linux kernel=6.15-rc2
Linux Linux kernel=6.15-rc3
Linux Linux kernel=6.15-rc4
Linux Linux kernel=6.15-rc5
Linux Linux kernel=6.15-rc6
Linux Linux kernel=6.15-rc7

Event History

Jun 18, 2025
CVE Published
via MITRE·09:33 AM
Data Sourced
via MITRE·09:33 AM
Description
Data Sourced
via NVD·10:15 AM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-38032?

CVE-2025-38032 has a medium severity rating of 5.5 on the CVSS scale.

2

How do I fix CVE-2025-38032?

To fix CVE-2025-38032, you can apply the available patch for the Linux kernel.

3

What is CVE-2025-38032 about?

CVE-2025-38032 addresses an issue in the Linux kernel related to the ipmr_can_free_table() checks.

4

Who reported CVE-2025-38032?

CVE-2025-38032 was reported by Guoyu Yin.

5

What software is affected by CVE-2025-38032?

CVE-2025-38032 affects the Linux kernel.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203