LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38524: rxrpc: Fix recv-recv race of completed call

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recv-recv race of completed call If a call receives an event (such as incoming data), the call gets placed on the socket's queue and a thread in recvmsg can be awakened to go and process it. Once the thread has picked up the call off of the queue, further events will cause it to be requeued, and once the socket lock is dropped (recvmsg uses call->user_mutex to allow the socket to be used in parallel), a second thread can come in and its recvmsg can pop the call off the socket queue again. In such a case, the first thread will be receiving stuff from the call and the second thread will be blocked on call->user_mutex. The first thread can, at this point, process both the event that it picked call for and the event that the second thread picked the call for and may see the call terminate - in which case the call will be "released", decoupling the call from the user call ID assigned to it (RXRPC_USER_CALL_ID in the control message). The first thread will return okay, but then the second thread will wake up holding the user_mutex and, if it sees that the call has been released by the first thread, it will BUG thusly: kernel BUG at net/rxrpc/recvmsg.c:474! Fix this by just dequeuing the call and ignoring it if it is seen to be already released. We can't tell userspace about it anyway as the user call ID has become stale.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A race condition in Linux RxRPC can crash the kernel when multiple threads receive events for the same completed call. Successful triggering affects availability, potentially interrupting services or rebooting a host. The supplied assessment rates it CVSS 7.5 because it is network-reachable, requires low complexity and no privileges or user interaction, but does not affect confidentiality or integrity.

Executive priority

Treat this as a high-priority availability issue for RxRPC-using Linux systems, especially business-critical or network-exposed hosts. Rapidly inventory exposure and apply supported kernel updates. Systems not using RxRPC are likely lower priority, but that conclusion should be validated. There is no supplied evidence of active exploitation.

Technical view

Concurrent recvmsg processing can dequeue the same RxRPC call twice. The first thread may process termination and release the call while the second waits on user_mutex. When the second resumes, encountering the released call triggers a kernel BUG in net/rxrpc/recvmsg.c. The fix discards an already-released dequeued call because its userspace call identifier is stale.

Likely exposure

Exposure is most relevant to systems running an affected Linux kernel and using RxRPC with concurrent receive activity. The bundle lists versions 4.9, 0, 6.6.100, 6.12.40, 6.15.8 and 6.16 as affected, but does not clearly define ranges or distribution backports. Confirm exposure against the running vendor kernel rather than version text alone.

Exploitation context

The supplied CVSS vector indicates network reachability, low attack complexity, no required privileges and availability-only impact. However, the bundle provides no public exploit evidence, triggering traffic details or proof of active exploitation. The CVE is not identified as being in CISA KEV, so active exploitation should not be claimed.

Researcher notes

The failure is a recv-recv synchronization race involving queue re-entry, user_mutex and call release. Impact is a deterministic kernel BUG if the race is reached, not documented memory disclosure or code execution. Version metadata is ambiguous, including a listed version “0” and repeated commit identifiers. Map distribution kernels by fix inclusion rather than assuming upstream version equivalence.

Mitigation direction

  • Update to a vendor-supported kernel containing the referenced RxRPC fix.
  • Check distribution security guidance for corrected package versions and backports.
  • Prioritize systems actively using RxRPC or exposing dependent network services.
  • Where updating is delayed, reduce unnecessary exposure of RxRPC-dependent services after operational review.

Validation and detection

  • Record the running kernel and compare it with vendor advisories, including backported fixes.
  • Determine whether RxRPC is enabled and actively used on each potentially affected system.
  • Verify the installed kernel contains the applicable referenced stable fix.
  • Review kernel logs for BUG events associated with net/rxrpc/recvmsg.c and unexpected outages.
  • After updating, confirm the corrected kernel is running following any required reboot.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38524 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2025-38524Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux248f219cb8bcbfbd7f132752d44afa2df7c241d1, 248f219cb8bcbfbd7f132752d44afa2df7c241d1, 248f219cb8bcbfbd7f132752d44afa2df7c241d1, 248f219cb8bcbfbd7f132752d44afa2df7c241d1unaffected
LinuxLinux4.9, 0, 6.6.100, 6.12.40, 6.15.8, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.