LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38544: rxrpc: Fix bug due to prealloc collision

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix bug due to prealloc collision When userspace is using AF_RXRPC to provide a server, it has to preallocate incoming calls and assign to them call IDs that will be used to thread related recvmsg() and sendmsg() together. The preallocated call IDs will automatically be attached to calls as they come in until the pool is empty. To the kernel, the call IDs are just arbitrary numbers, but userspace can use the call ID to hold a pointer to prepared structs. In any case, the user isn't permitted to create two calls with the same call ID (call IDs become available again when the call ends) and EBADSLT should result from sendmsg() if an attempt is made to preallocate a call with an in-use call ID. However, the cleanup in the error handling will trigger both assertions in rxrpc_cleanup_call() because the call isn't marked complete and isn't marked as having been released. Fix this by setting the call state in rxrpc_service_prealloc_one() and then marking it as being released before calling the cleanup function.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-38544 is a Linux kernel rxrpc bug in handling preallocated server call IDs. If userspace tries to reuse an in-use call ID, error cleanup can hit kernel assertions instead of handling the duplicate cleanly. Business risk is unclear because no CVSS, CWE, or exploitation evidence is provided.

Executive priority

Treat as a patch-management item with uncertain severity. Prioritize affected Linux servers using AF_RXRPC, but do not treat it as an emergency based on the supplied evidence because exploitation and impact are not confirmed.

Technical view

In AF_RXRPC server mode, rxrpc_service_prealloc_one() can create a preallocated call with a colliding call ID. The duplicate should fail with EBADSLT, but cleanup calls rxrpc_cleanup_call() before the call is marked complete or released, triggering assertions. Stable commits mark state and release status before cleanup.

Likely exposure

Exposure appears limited to Linux systems running affected kernel builds where userspace uses AF_RXRPC to provide a server. The source bundle does not establish broad network exposure, affected distributions, or whether unprivileged local users can trigger the condition.

Exploitation context

The source bundle marks KEV false and provides no evidence of active exploitation, public exploit code, or real-world attacks. The described trigger is duplicate AF_RXRPC preallocated call IDs during userspace server operation; attacker reachability is not established.

Researcher notes

The core issue is cleanup state inconsistency after a preallocation collision. The record lacks CVSS, CWE, privilege requirements, remote reachability, and distribution package mapping. Analysis should focus on whether AF_RXRPC server usage exists and whether vendor kernels include the stable fix.

Mitigation direction

  • Update to a kernel or distribution package containing the referenced stable fixes.
  • Check vendor advisories for fixed versions mapped to your Linux distribution.
  • Prioritize hosts that run AF_RXRPC server workloads.
  • Monitor for kernel oops or assertion reports involving rxrpc cleanup.
  • Avoid direct deployment shortcuts; follow normal kernel change controls.

Validation and detection

  • Inventory kernel versions across Linux hosts.
  • Confirm the relevant stable fix commit is present in deployed kernel source or package notes.
  • Identify systems using AF_RXRPC server functionality.
  • Review kernel logs for rxrpc_cleanup_call assertion failures.
  • Track distro advisories until package-level fixed versions are explicit.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38544 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux00e907127e6f86d0f9b122d9b4347a8aa09a8b61, 00e907127e6f86d0f9b122d9b4347a8aa09a8b61, 00e907127e6f86d0f9b122d9b4347a8aa09a8b61, 00e907127e6f86d0f9b122d9b4347a8aa09a8b61unaffected
LinuxLinux4.9, 0, 6.6.99, 6.12.39, 6.15.7, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.