LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38525: rxrpc: Fix irq-disabled in local_bh_enable()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix irq-disabled in local_bh_enable() The rxrpc_assess_MTU_size() function calls down into the IP layer to find out the MTU size for a route. When accepting an incoming call, this is called from rxrpc_new_incoming_call() which holds interrupts disabled across the code that calls down to it. Unfortunately, the IP layer uses local_bh_enable() which, config dependent, throws a warning if IRQs are enabled: WARNING: CPU: 1 PID: 5544 at kernel/softirq.c:387 __local_bh_enable_ip+0x43/0xd0 ... RIP: 0010:__local_bh_enable_ip+0x43/0xd0 ... Call Trace: <TASK> rt_cache_route+0x7e/0xa0 rt_set_nexthop.isra.0+0x3b3/0x3f0 __mkroute_output+0x43a/0x460 ip_route_output_key_hash+0xf7/0x140 ip_route_output_flow+0x1b/0x90 rxrpc_assess_MTU_size.isra.0+0x2a0/0x590 rxrpc_new_incoming_peer+0x46/0x120 rxrpc_alloc_incoming_call+0x1b1/0x400 rxrpc_new_incoming_call+0x1da/0x5e0 rxrpc_input_packet+0x827/0x900 rxrpc_io_thread+0x403/0xb60 kthread+0x2f7/0x310 ret_from_fork+0x2a/0x230 ret_from_fork_asm+0x1a/0x30 ... hardirqs last enabled at (23): _raw_spin_unlock_irq+0x24/0x50 hardirqs last disabled at (24): _raw_read_lock_irq+0x17/0x70 softirqs last enabled at (0): copy_process+0xc61/0x2730 softirqs last disabled at (25): rt_add_uncached_list+0x3c/0x90 Fix this by moving the call to rxrpc_assess_MTU_size() out of rxrpc_init_peer() and further up the stack where it can be done without interrupts disabled. It shouldn't be a problem for rxrpc_new_incoming_call() to do it after the locks are dropped as pmtud is going to be performed by the I/O thread - and we're in the I/O thread at this point.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel RxRPC flaw can mishandle interrupt state while processing an incoming call and checking network route size. The supplied CVSS rates it 7.5 because a network-accessible condition could affect availability. The evidence does not show data theft, data modification, or confirmed real-world exploitation.

Executive priority

Prioritize internet-facing or otherwise untrusted-network systems using RxRPC. Treat remediation as high priority because the supplied score indicates remotely triggerable availability risk, but avoid declaring an incident solely from this CVE: active exploitation is not evidenced. Validate packaged-kernel status with each distribution before scheduling emergency changes.

Technical view

While accepting an RxRPC call, rxrpc_new_incoming_call() retained disabled interrupts as rxrpc_assess_MTU_size() entered the IP routing layer. That layer can invoke local_bh_enable(), producing an invalid execution context and kernel warning. The fix relocates MTU assessment until after relevant locks are dropped and interrupts are no longer disabled.

Likely exposure

Exposure requires an affected Linux kernel and execution of the vulnerable RxRPC incoming-call path. Risk is greatest where RxRPC is enabled, used, and reachable from untrusted networks. The supplied version data is ambiguous, so administrators should confirm affected and fixed builds against kernel or distribution advisories.

Exploitation context

The CVSS vector describes remote, low-complexity, unauthenticated availability impact without user interaction. However, the bundle marks this CVE absent from KEV and provides no evidence of active exploitation, public exploit code, or demonstrated weaponization. Practical impact beyond the reported warning is not established here.

Researcher notes

The source describes an interrupt-context correctness flaw, not memory corruption. Four stable-kernel commits are referenced, apparently covering separate maintained branches. The flattened affected-version list contains unusual identifiers and does not clearly express ranges or backports; branch-specific commit ancestry and distribution advisories are therefore necessary for reliable exposure determination.

Mitigation direction

  • Update to a vendor-supported kernel containing the applicable stable fix.
  • Check Linux distribution advisories to map packaged kernel versions accurately.
  • Restrict untrusted network access to RxRPC-dependent services where operationally feasible.
  • Follow vendor guidance if an immediate kernel update is unavailable.

Validation and detection

  • Inventory running kernel versions across systems and compare them with vendor advisories.
  • Determine whether RxRPC is enabled, actively used, and reachable from untrusted networks.
  • Confirm the installed kernel includes the applicable referenced stable commit or vendor backport.
  • Review kernel logs for matching softirq warnings and RxRPC call traces after controlled functional testing.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38525 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2025-38525Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux77433b730970ca6e51d03016e830d8ab1b22685a, 09c59a82298f424f6212c67fbea531853e88ce6c, a2ea9a9072607c2fd6442bd1ffb4dbdbf882aed7, a2ea9a9072607c2fd6442bd1ffb4dbdbf882aed7, 6.6.148, 6.12.101unaffected
LinuxLinux6.14, 0, 6.6.151, 6.12.103, 6.15.8, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.