LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38089: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error

In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If decoding the RPC reply fails in such a way that SVC_GARBAGE is returned without setting the rq_accept_statp pointer, then that pointer can be dereferenced and a value stored there. If it's the first time the thread has processed an RPC, then that pointer will be set to NULL and the kernel will crash. In other cases, it could create a memory scribble. The server sunrpc code treats a SVC_GARBAGE return from svc_authenticate or pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531 says that if authentication fails that the RPC should be rejected instead with a status of AUTH_ERR. Handle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of AUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This sidesteps the whole problem of touching the rpc_accept_statp pointer in this situation and avoids the crash.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A remote, unauthenticated client can send a malformed request to a reachable Linux kernel RPC server and crash the kernel. Other executions may corrupt kernel memory. This can disrupt NFS or other RPC-dependent services and potentially the host, although the supplied evidence does not demonstrate data theft or code execution.

Executive priority

Treat reachable production RPC servers as an urgent patching priority because an unauthenticated network request can crash the operating system. Prioritize internet-facing, shared-storage, and high-availability systems. Internal hosts with tightly restricted RPC access remain important but may be sequenced behind directly exposed systems.

Technical view

An authentication-decoding failure can return SVC_GARBAGE without initializing rq_accept_statp. Subsequent GARBAGE_ARGS handling may dereference NULL on a thread’s first RPC or scribble memory otherwise. The kernel fix treats this result as AUTH_ERROR with AUTH_BADCRED, avoiding the unsafe pointer access and aligning behavior with RFC 5531.

Likely exposure

Exposure requires a Linux host running a kernel RPC server reachable by an attacker. The bundle marks several kernel versions affected, including 6.4, 6.6.95, 6.12.35, 6.15.4, and 6.16, but its version and commit entries are ambiguous. Distribution backports must be checked against vendor advisories and referenced fixes.

Exploitation context

The bundle marks this CVE as absent from KEV. It references the public NFSundown research repository, but does not establish active attacks or verified weaponization. Remotely triggered crashes are supported by the description; broader confidentiality or integrity impact is scored by CVSS but not demonstrated in the supplied narrative.

Researcher notes

The core issue is unsafe state handling across authentication failure and reply generation, not ordinary RPC argument decoding. The documented outcomes are NULL dereference and memory scribble. The supplied CVSS is 9.8, but the narrative does not substantiate practical code execution or data compromise. Exact affected-package boundaries require distribution-specific confirmation.

Mitigation direction

  • Update to a vendor-supported Linux kernel containing the applicable stable fix.
  • Restrict untrusted network access to kernel RPC and NFS services until affected hosts are updated.
  • Consult distribution advisories to map packaged kernels and backports to the referenced stable commits.
  • Prioritize externally reachable RPC servers and systems where an unexpected reboot would materially disrupt operations.

Validation and detection

  • Inventory hosts running kernel RPC or NFS server functionality and record their exact packaged kernel versions.
  • Check vendor changelogs or advisories for backports of the referenced sunrpc fix.
  • Confirm firewalls prevent untrusted clients from reaching exposed RPC services.
  • Review kernel logs for RPC-associated oops, panic, NULL dereference, or unexplained reboot events.
  • After updating, verify the running kernel matches the patched package and reboot completed successfully.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38089 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
7Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2025-38089Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux29cd2927fb914cc53b5ba4f67d2b74695c994ba4, 29cd2927fb914cc53b5ba4f67d2b74695c994ba4, 29cd2927fb914cc53b5ba4f67d2b74695c994ba4, 29cd2927fb914cc53b5ba4f67d2b74695c994ba4, 9b59f5c4911e87264507e0934cd2bb277390c560, 6.3.4unaffected
LinuxLinux6.4, 0, 6.6.95, 6.12.35, 6.15.4, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.