LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38102: VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify

In the Linux kernel, the following vulnerability has been resolved: VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify During our test, it is found that a warning can be trigger in try_grab_folio as follow: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1678 at mm/gup.c:147 try_grab_folio+0x106/0x130 Modules linked in: CPU: 0 UID: 0 PID: 1678 Comm: syz.3.31 Not tainted 6.15.0-rc5 #163 PREEMPT(undef) RIP: 0010:try_grab_folio+0x106/0x130 Call Trace: <TASK> follow_huge_pmd+0x240/0x8e0 follow_pmd_mask.constprop.0.isra.0+0x40b/0x5c0 follow_pud_mask.constprop.0.isra.0+0x14a/0x170 follow_page_mask+0x1c2/0x1f0 __get_user_pages+0x176/0x950 __gup_longterm_locked+0x15b/0x1060 ? gup_fast+0x120/0x1f0 gup_fast_fallback+0x17e/0x230 get_user_pages_fast+0x5f/0x80 vmci_host_unlocked_ioctl+0x21c/0xf80 RIP: 0033:0x54d2cd ---[ end trace 0000000000000000 ]--- Digging into the source, context->notify_page may init by get_user_pages_fast and can be seen in vmci_ctx_unset_notify which will try to put_page. However get_user_pages_fast is not finished here and lead to following try_grab_folio warning. The race condition is shown as follow: cpu0 cpu1 vmci_host_do_set_notify vmci_host_setup_notify get_user_pages_fast(uva, 1, FOLL_WRITE, &context->notify_page); lockless_pages_from_mm gup_pgd_range gup_huge_pmd // update &context->notify_page vmci_host_do_set_notify vmci_ctx_unset_notify notify_page = context->notify_page; if (notify_page) put_page(notify_page); // page is freed __gup_longterm_locked __get_user_pages follow_trans_huge_pmd try_grab_folio // warn here To slove this, use local variable page to make notify_page can be seen after finish get_user_pages_fast.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A race condition in the Linux kernel’s VMCI notification handling can free a memory page while another operation is still acquiring it. A low-privileged local user could potentially trigger serious confidentiality, integrity, or availability impact. The supplied evidence does not establish remote reachability or exploitation in the wild.

Executive priority

Treat this as a high-priority local privilege-boundary issue, especially on shared systems. Patch through supported kernel channels after compatibility testing. Internet-facing status alone does not determine exposure because the stated attack vector is local. Escalate systems combining affected kernels, VMCI availability, and untrusted local accounts.

Technical view

Concurrent VMCI notification setup and removal can expose context->notify_page before get_user_pages_fast completes. The removal path may then call put_page while page acquisition continues, producing an unsafe page-lifetime race. The kernel fix uses a local page variable and publishes notify_page only after acquisition finishes.

Likely exposure

Exposure is most likely on affected Linux kernels where VMCI is available and an untrusted local user can reach the relevant ioctl path. The bundle identifies multiple affected kernel releases but provides no CPEs, deployment prevalence, or configuration-specific determination. Confirm exposure using distribution advisories and kernel provenance.

Exploitation context

The CVSS 3.1 score is 7.8 with local access, low complexity, low privileges, no user interaction, and high potential impact. The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or a public weaponized exploit.

Researcher notes

The supplied trace demonstrates the race as a kernel warning, while the CVSS asserts high confidentiality, integrity, and availability impact. The bundle does not document a proven privilege-escalation outcome, root-cause CWE, exploit reliability, or affected configuration matrix. Avoid equating the warning alone with demonstrated code execution.

Mitigation direction

  • Install the applicable vendor or distribution kernel update containing the referenced stable fix.
  • Prioritize multi-user, shared-hosting, and other systems permitting untrusted local access.
  • If immediate patching is impossible, consult vendor guidance for supported VMCI-specific risk reduction.
  • Reboot into the updated kernel where required by the distribution.

Validation and detection

  • Record the running kernel release and package build on each potentially exposed system.
  • Compare installed builds with the CVE record and applicable distribution security advisory.
  • Confirm the updated kernel is active after patching, not merely installed.
  • Determine whether VMCI is available and reachable by untrusted local users.
  • Review kernel logs for related VMCI, get-user-pages, or try_grab_folio warnings.
Prepared
Confidence
high
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38102 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-38102Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa1d88436d53a75e950db15834b3d2f8c0c358fdc, a1d88436d53a75e950db15834b3d2f8c0c358fdc, a1d88436d53a75e950db15834b3d2f8c0c358fdc, a1d88436d53a75e950db15834b3d2f8c0c358fdc, a1d88436d53a75e950db15834b3d2f8c0c358fdc, a1d88436d53a75e950db15834b3d2f8c0c358fdc, a1d88436d53a75e950db15834b3d2f8c0c358fdc, a1d88436d53a75e950db15834b3d2f8c0c358fdcunaffected
LinuxLinux4.0, 0, 5.4.296, 5.10.240, 5.15.186, 6.1.142, 6.6.94, 6.12.34, 6.15.3, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.