CVE-2025-38102: VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify

Published Jul 3, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

VMCI: fix race between vmcihostsetupnotify and vmcictxunsetnotify

During our test, it is found that a warning can be trigger in trygrabfolio as follow:

------------[ cut here ]------------ WARNING: CPU: 0 PID: 1678 at mm/gup.c:147 trygrabfolio+0x106/0x130 Modules linked in: CPU: 0 UID: 0 PID: 1678 Comm: syz.3.31 Not tainted 6.15.0-rc5 #163 PREEMPT(undef) RIP: 0010:trygrabfolio+0x106/0x130 Call Trace: <TASK> followhugepmd+0x240/0x8e0 followpmdmask.constprop.0.isra.0+0x40b/0x5c0 followpudmask.constprop.0.isra.0+0x14a/0x170 followpagemask+0x1c2/0x1f0 getuserpages+0x176/0x950 guplongtermlocked+0x15b/0x1060 ? gupfast+0x120/0x1f0 gupfastfallback+0x17e/0x230 getuserpagesfast+0x5f/0x80 vmcihostunlockedioctl+0x21c/0xf80 RIP: 0033:0x54d2cd ---[ end trace 0000000000000000 ]---

Digging into the source, context->notifypage may init by getuserpagesfast and can be seen in vmcictxunsetnotify which will try to putpage. However getuserpagesfast is not finished here and lead to following trygrabfolio warning. The race condition is shown as follow:

cpu0 cpu1 vmcihostdosetnotify vmcihostsetupnotify getuserpagesfast(uva, 1, FOLLWRITE, &context->notifypage); locklesspagesfrommm guppgdrange guphugepmd // update &context->notifypage vmcihostdosetnotify vmcictxunsetnotify notifypage = context->notifypage; if (notifypage) putpage(notifypage); // page is freed guplongtermlocked getuserpages followtranshugepmd trygrabfolio // warn here

To slove this, use local variable page to make notifypage can be seen after finish getuserpagesfast.

Affected Software

10 affected componentsFixes available

Linux Linux kernel

Linux Linux kernel>=4.0<5.4.296

Linux Linux kernel>=5.5<5.10.240

Linux Linux kernel>=5.11<5.15.186

Linux Linux kernel>=5.16<6.1.142

Linux Linux kernel>=6.2<6.6.94

Linux Linux kernel>=6.7<6.12.34

Linux Linux kernel>=6.13<6.15.3

Debian Debian Linux=11.0

debian/linux

6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-17.2.13-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Compensating control
In VMCI notification setup, store the result of get_user_pages_fast in a local page variable and assign it to context->notify_page only after get_user_pages_fast completes, so vmci_ctx_unset_notify cannot put_page() while the page lookup is still in progress.

Event History

Jul 3, 2025

CVE Published

via MITRE·08:35 AM

Data Sourced

via MITRE·08:35 AM

DescriptionSeverity

Data Sourced

via NVD·09:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-5973

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2025-38102?

CVE-2025-38102 is classified as a moderate severity vulnerability affecting the Linux kernel.

How do I fix CVE-2025-38102?

To fix CVE-2025-38102, update your Linux kernel to the latest version that addresses this vulnerability.

Which versions of the Linux kernel are affected by CVE-2025-38102?

CVE-2025-38102 affects multiple versions of the Linux kernel, particularly those prior to the latest patches.

What type of vulnerabilities are addressed by CVE-2025-38102?

CVE-2025-38102 addresses a race condition vulnerability in the VMCI component of the Linux kernel.

Is CVE-2025-38102 exploitable in production environments?

Yes, CVE-2025-38102 has the potential to be exploited in production environments if unpatched.