Executive brief
A race condition vulnerability was identified in the Linux kernel's implementation of the RxRPC network protocol. This protocol is used for remote procedure calls, often in distributed file systems like AFS. An exploit could allow a remote attacker to trigger a system crash (kernel panic), leading to a complete denial of service for the affected server.
Technical details
A race condition exists in net/rxrpc/recvmsg.c within the Linux kernel's AF_RXRPC implementation. When multiple threads concurrently call recvmsg on the same socket, one thread may process a call termination and release the call object while a second thread is blocked on call->user_mutex. Upon waking, the second thread encounters a released call state, triggering a 'kernel BUG' at line 474. The vulnerability is rooted in improper synchronization during call completion events. The fix involves checking the RXRPC_CALL_RELEASED flag after acquiring the mutex and safely dequeuing/ignoring the stale call. Patches have been released for various stable branches including 6.6.y, 6.12.y, and 6.15.y.
Affected products
- Linux Linux Kernel 4.9 to 6.6.100, 6.12.40, 6.15.8
Timeline
- 2025-07-17: disclosed: Initial patch submission by David Howells
- 2025-07-24: patched: Patches committed to stable kernel trees
- 2025-08-16: advisory: CVE-2025-38524 published