CVE-2025-38461: vsock: Fix transport_* TOCTOU
In the Linux kernel, the following vulnerability has been resolved:
vsock: Fix transport TOCTOU
Transport assignment may race with module unload. Protect newtransport from becoming a stale pointer.
This also takes care of an insecure call in vsockuselocaltransport(); add a lockdep assert.
BUG: unable to handle page fault for address: fffffbfff8056000 Oops: Oops: 0000 [#1] SMP KASAN RIP: 0010:vsockassigntransport+0x366/0x600 Call Trace: vsockconnect+0x59c/0xc40 sysconnect+0xe8/0x100 x64sysconnect+0x6e/0xc0 dosyscall64+0x92/0x1c0 entrySYSCALL64afterhwframe+0x4b/0x53
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38461?
CVE-2025-38461 is classified as a medium severity vulnerability due to the potential for race conditions in the transport assignment.
How do I fix CVE-2025-38461?
To fix CVE-2025-38461, update your Linux kernel to a patched version that resolves the transport assignment race condition.
What systems are affected by CVE-2025-38461?
CVE-2025-38461 affects various versions of the Linux kernel that implement the vsock transport functionality.
What are the consequences of CVE-2025-38461 if exploited?
Exploitation of CVE-2025-38461 could lead to the use of stale pointers, potentially causing system instability or denial of service.
Is CVE-2025-38461 related to module unloading in the Linux kernel?
Yes, CVE-2025-38461 relates to a race condition that occurs during the unloading of modules, which can affect transport assignments.