LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38002: io_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo()

In the Linux kernel, the following vulnerability has been resolved: io_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo() Not everything requires locking in there, which is why the 'has_lock' variable exists. But enough does that it's a bit unwieldy to manage. Wrap the whole thing in a ->uring_lock trylock, and just return with no output if we fail to grab it. The existing trylock() will already have greatly diminished utility/output for the failure case. This fixes an issue with reading the SQE fields, if the ring is being actively resized at the same time.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local, low-privileged user may trigger a race while Linux reports io_uring diagnostic information and the ring is resized. The supplied CVSS assessment indicates possible compromise of confidentiality, integrity, and availability. This is primarily a host and multi-user workload risk, not a remotely reachable flaw by itself.

Executive priority

Treat this as a high-priority kernel maintenance issue for multi-user, shared-compute, and container-hosting systems. Schedule prompt vendor-supported updates, while recognizing that the evidence does not show remote or active exploitation. Single-purpose systems without untrusted local access may be prioritized through normal risk-based patch sequencing.

Technical view

io_uring_show_fdinfo() could read submission queue entry fields while an io_uring instance was being resized. The correction attempts to acquire ctx->uring_lock around the operation and returns without output if locking fails, preventing access to changing state. The supplied vector is CVSS 3.1 7.8: local access, low privileges, no user interaction.

Likely exposure

Potential exposure exists on affected Linux kernels where low-privileged local users or workloads can use io_uring and access relevant fdinfo data. The bundle lists 6.13, 6.14.8, and 6.15 boundary data, but its exact range representation is ambiguous. Confirm applicability through the operating-system vendor’s advisory and kernel build mapping.

Exploitation context

The supplied record is not in CISA KEV and provides no evidence of active exploitation. A public Project Zero issue is referenced, indicating public technical scrutiny, but the bundle does not establish exploit availability, reliability, or real-world attacks. Local authenticated access is required according to the CVSS vector.

Researcher notes

The flaw is a locking race in the fdinfo reporting path during concurrent io_uring resizing. The fix broadens uring_lock coverage and suppresses output when trylock fails. The source bundle provides no CWE, crash signature, exploit evidence, or precise distribution package mapping. Validate backports by commit equivalence rather than version labels alone.

Mitigation direction

  • Install a vendor-supported kernel update containing the cited stable fix.
  • Consult distribution guidance to map the fix commits to packaged kernel versions.
  • Prioritize shared hosts and systems running workloads from less-trusted local users.
  • If updating is delayed, review vendor-recommended temporary mitigations; none are specified in the bundle.

Validation and detection

  • Inventory running kernel builds across Linux hosts.
  • Check each distribution advisory for CVE-2025-38002 and its fixed package versions.
  • Verify updated hosts are running the patched kernel after maintenance.
  • Confirm vendor patches include either cited stable correction or an equivalent backport.
  • Review affected hosts for exposure to low-privileged local users and workloads.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38002 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-38002Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux79cfe9e59c2a12c3b3faeeefe38d23f3d8030972, 79cfe9e59c2a12c3b3faeeefe38d23f3d8030972unaffected
LinuxLinux6.13, 0, 6.14.8, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.