Security readout for executives and security teams
Plain-English summary
A flaw in Linux virtual-socket handling can trigger use-after-free memory corruption when a connection reaches a socket improperly bound to the automatic-port value. A local, low-privileged attacker could potentially compromise confidentiality, integrity, and availability. The supplied evidence does not establish remote reachability.
Executive priority
Treat as a high-priority kernel update for multi-user, hosting, virtualization, and workload-isolation environments. It is not supported as an internet-remote or actively exploited emergency by the supplied evidence, but successful exploitation could cause complete system impact within the affected host context.
Technical view
Linux vsock allowed binding a connectible socket to VMADDR_PORT_ANY. An accepted socket could retain that port without appearing on the unbound-socket list; rebinding could then cause an extra reference-count decrement and use-after-free. The fix rejects VMADDR_PORT_ANY in __vsock_bind_connectible(). CVSS 3.1 is 7.8 with local attack vector.
Likely exposure
Exposure centers on affected Linux kernels where an attacker has low-privileged local access and can reach the relevant vsock behavior. Virtualized systems using vsock deserve particular review. The supplied version data mixes release numbers and commit identifiers, so administrators should confirm affected and fixed package versions with their Linux distributor.
Exploitation context
The CVSS vector requires local access, low privileges, low complexity, and no user interaction. The source bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit.
Researcher notes
The vulnerable lifecycle involves autobinding or binding to VMADDR_PORT_ANY, accepted-socket bookkeeping, and an erroneous additional reference decrement during rebinding. Review backports rather than relying solely on upstream version numbers. The bundle provides no CWE assignment, exploit evidence, or detailed configuration prerequisites.
Mitigation direction
- Install a vendor-supported kernel update that includes the VMADDR_PORT_ANY binding fix.
- Reboot into the updated kernel when required by the distribution.
- Check Linux distributor advisories for exact affected and corrected package versions.
- Prioritize updates on systems granting untrusted users or workloads local access.
Validation and detection
- Record the running kernel version and compare it with distributor guidance for CVE-2025-38618.
- Confirm the installed update contains the referenced upstream vsock fix.
- Verify the system booted into the corrected kernel after maintenance.
- Review whether local users or workloads can access vsock functionality.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38618 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c04a2c1ca25b9b23104124d3b2d349d934e302deCVE reference, Linux
- https://git.kernel.org/stable/c/d1a5b1964cef42727668ac0d8532dae4f8c19386CVE reference, Linux
- https://git.kernel.org/stable/c/cf86704798c1b9c46fa59dfc2d662f57d1394d79CVE reference, Linux
- https://git.kernel.org/stable/c/f138be5d7f301fddad4e65ec66dfc3ceebf79be3CVE reference, Linux
- https://git.kernel.org/stable/c/44bd006d5c93f6a8f28b106cbae2428c5d0275b7CVE reference, Linux
- https://git.kernel.org/stable/c/32950b1907919be86a7a2697d6f93d57068b3865CVE reference, Linux
- https://git.kernel.org/stable/c/8f01093646b49f6330bb2d36761983fd829472b1CVE reference, Linux
- https://git.kernel.org/stable/c/d73960f0cf03ef1dc9e96ec7a20e538accc26d87CVE reference, Linux
- https://git.kernel.org/stable/c/aba0c94f61ec05315fa7815d21aefa4c87f6a9f4CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.