Security readout for executives and security teams
Plain-English summary
A race condition in the Linux kernel's virtual-socket transport handling can leave the kernel using an invalid pointer while a transport module unloads. A local, low-privileged user may be able to trigger memory corruption affecting confidentiality, integrity, or availability, although exploitation requires difficult timing and no active exploitation is established.
Executive priority
Treat as a high-priority kernel maintenance issue on shared or untrusted-compute systems. Internet exposure alone does not make it remotely exploitable. Patch through normal emergency change controls, prioritizing hosts offering local access or tenant workloads; broader fleet remediation can follow risk-based scheduling.
Technical view
CVE-2025-38461 is a time-of-check/time-of-use race in Linux vsock transport assignment. Concurrent module unloading can make new_transport stale before use, producing a KASAN-observed page fault in vsock_assign_transport during connect. The correction protects transport selection and adds a lock-state assertion around local-transport use.
Likely exposure
Exposure is limited to Linux systems running an affected kernel where vsock transports are available and a low-privileged local user can reach the vulnerable path. The supplied version list is ambiguous, so determine status using distribution advisories, kernel changelogs, or presence of the cited stable fix.
Exploitation context
The CVSS vector is local, high-complexity, low-privilege, and requires no user interaction. Successful abuse depends on racing transport assignment against module unloading. The bundle marks KEV false and provides no evidence of public or active exploitation; demonstrated evidence is a kernel crash under KASAN.
Researcher notes
The supplied crash trace supports a stale-pointer failure in vsock_assign_transport, but does not demonstrate controlled exploitation. Assess reachability through socket creation and transport availability without attempting weaponization. The flattened affected-version data is insufficient for precise branch boundaries; use stable commits and distribution package advisories for authoritative backport status.
Mitigation direction
- Install the vendor-supported kernel update containing the applicable cited stable fix.
- Prioritize multi-user, virtualization, and container hosts where untrusted local workloads can access vsock.
- If updating is delayed, consult vendor guidance for supported exposure-reduction measures.
- Reboot into the updated kernel and remove superseded vulnerable kernels where operationally appropriate.
Validation and detection
- Record the running kernel release and distribution package version on each potentially exposed host.
- Compare package status with the applicable distribution advisory and cited stable kernel fix.
- Confirm whether vsock transports are enabled, loaded, and accessible to untrusted local users or workloads.
- After remediation, verify the updated kernel is running following reboot.
- Monitor kernel logs for vsock-related faults, KASAN reports, or unexpected module-unload crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38461 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8667e8d0eb46bc54fdae30ba2f4786407d3d88ebCVE reference, Linux
- https://git.kernel.org/stable/c/36a439049b34cca0b3661276049b84a1f76cc21aCVE reference, Linux
- https://git.kernel.org/stable/c/9ce53e744f18e73059d3124070e960f3aa9902bfCVE reference, Linux
- https://git.kernel.org/stable/c/9d24bb6780282b0255b9929abe5e8f98007e2c6eCVE reference, Linux
- https://git.kernel.org/stable/c/ae2c712ba39c7007de63cb0c75b51ce1caaf1da5CVE reference, Linux
- https://git.kernel.org/stable/c/7b73bddf54777fb62d4d8c7729d0affe6df04477CVE reference, Linux
- https://git.kernel.org/stable/c/687aa0c5581b8d4aa87fd92973e4ee576b550cdfCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.