In the Linux kernel, the following vulnerability has been resolved:
net: kcm: Fix race condition in kcm_unattach()
syzbot found a race condition when kcm_unattach(psock)
and kcm_release(kcm) are executed at the same time.
kcm_unattach() is missing a check of the flag
kcm->tx_stopped before calling queue_work().
If the kcm has a reserved psock, kcm_unattach() might get executed
between cancel_work_sync() and unreserve_psock() in kcm_release(),
requeuing kcm->tx_work right before kcm gets freed in kcm_done().
Remove kcm->tx_stopped and replace it by the less
error-prone disable_work_sync().
References
Configurations
Configuration 1 (hide)
|
History
25 Nov 2025, 22:07
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/52565a935213cd6a8662ddb8efe5b4219343a25d - Patch | |
| References | () https://git.kernel.org/stable/c/7275dc3bb8f91b23125ff3f47b6529935cf46152 - Patch | |
| References | () https://git.kernel.org/stable/c/798733ee5d5788b12e8a52db1519abc17e826f69 - Patch | |
| References | () https://git.kernel.org/stable/c/c0bffbc92a1ca3960fb9cdb8e9f75a68468eb308 - Patch | |
| CWE | CWE-362 | |
| First Time |
Linux linux Kernel
Linux |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.7 |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:* |
Information
Published : 2025-09-04 16:15
Updated : 2025-11-25 22:07
NVD link : CVE-2025-38717
Mitre link : CVE-2025-38717
CVE.ORG link : CVE-2025-38717
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')