Security readout for executives and security teams
Plain-English summary
CVE-2025-38491 is a race condition in Linux Multipath TCP fallback handling. Concurrent network and socket-close activity can leave fallback processing inconsistent, triggering kernel warnings and potentially disrupting service. Its supplied CVSS score is 8.2: network reachable without privileges or user action, with high availability and low integrity impact; no confidentiality impact is claimed.
Executive priority
Treat this as a high-priority patching issue, not an emergency based solely on current evidence. Accelerate remediation for affected, network-reachable systems using MPTCP, especially availability-critical servers and appliances. No active exploitation is documented. Resolve uncertain vendor backport status promptly because upstream version metadata alone may not accurately represent distribution or embedded-product exposure.
Technical view
The flaw occurs between deciding whether MPTCP should fall back and performing that fallback. The trace shows incoming TCP/MPTCP option processing overlapping listener shutdown and socket closure. Stable-kernel commits make the decision and action atomic. Syzkaller reproduced a kernel warning on 6.16-rc3; the bundle does not establish code execution, data disclosure, or a full kernel panic.
Likely exposure
Exposure is limited to Linux systems running listed affected kernel revisions, particularly where MPTCP is enabled and relevant sockets receive network traffic. The version data mixes releases and commit hashes and includes an ambiguous “0,” so distribution package status and backports require verification. The supplied default status is unaffected outside identified ranges.
Exploitation context
KEV is false, and no supplied source reports active exploitation or a public exploit. Evidence consists of a Syzkaller-generated kernel warning and a network-reachable CVSS vector. Remote availability impact should be treated seriously, but real-world exploit reliability and required operating conditions are not established by the bundle.
Researcher notes
Primary evidence is the upstream resolution description, Syzkaller trace, affected-version metadata, and stable commits. The trace supports a concurrency defect spanning MPTCP fallback and socket-close paths. CVSS asserts network reachability and high availability impact, but the bundle omits exploit prerequisites, reproducibility beyond fuzzing, and evidence of remote code execution. Debian and Siemens references may refine product-specific applicability.
Mitigation direction
- Apply a vendor kernel update containing the applicable referenced stable fix.
- Use distribution or device-vendor advisories to account for backported fixes.
- Prioritize availability-critical systems running affected kernels with MPTCP enabled.
- If no update is available, obtain product-specific mitigation guidance from the vendor.
Validation and detection
- Inventory each running kernel release and build, including embedded and appliance systems.
- Compare installed packages against vendor-specific affected and corrected versions.
- Confirm whether MPTCP is enabled and relevant services receive reachable network traffic.
- Review kernel logs for warnings involving mptcp_do_fallback or mptcp_incoming_options.
- After updating, confirm the corrected kernel is running and services operate normally.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38491 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H3.94.2LinuxVulnerability scoring details
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5586518bec27666c747cd52aabb62d485686d0bfCVE reference, Linux
- https://git.kernel.org/stable/c/75a4c9ab8a7af0d76b31ccd1188ed178c38b35d2CVE reference, Linux
- https://git.kernel.org/stable/c/54999dea879fecb761225e28f274b40662918c30CVE reference, Linux
- https://git.kernel.org/stable/c/1d82a8fe6ee4afdc92f4e8808c9dad2a6095bbc5CVE reference, Linux
- https://git.kernel.org/stable/c/f8a1d9b18c5efc76784f5a326e905f641f839894CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.