CVE-2025-38462

vsock: Fix transport_{g2h,h2g} TOCTOU

State: Published
Severity: Not scored
Published: Jul 25, 2025
Updated: May 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

vsock: Fix transport_{g2h,h2g} TOCTOU

vsock_find_cid() and vsock_dev_do_ioctl() may race with module unload. transport_{g2h,h2g} may become NULL after the NULL check.

Introduce vsock_transport_local_cid() to protect from a potential null-ptr-deref.

KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] RIP: 0010:vsock_find_cid+0x47/0x90 Call Trace: __vsock_bind+0x4b2/0x720 vsock_bind+0x90/0xe0 __sys_bind+0x14d/0x1e0 __x64_sys_bind+0x6e/0xc0 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53

KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] RIP: 0010:vsock_dev_do_ioctl.isra.0+0x58/0xf0 Call Trace: __x64_sys_ioctl+0x12d/0x190 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before c5496ee685c48ed1cc183cd4263602579bb4a615Affected c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 80d7dc15805a93d520a249ac6d13d4f4df161c1bAffected c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 5752d8dbb3dfd7f1a9faf0f65377e60826ea9a17Affected c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 401239811fa728fcdd53e360a91f157ffd23e1f4Affected c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 3734d78210cceb2ee5615719a62a5c55ed381ff8Affected c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 6a1bcab67bea797d83aa9dd948a0ac6ed52d121dAffected c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 209fd720838aaf1420416494c5505096478156b4Affected
LinuxLinux	5.5Affected before 5.5Not affected 5.10.240 through 5.10.Not affected 5.15.189 through 5.15.Not affected 6.1.146 through 6.1.Not affected 6.6.99 through 6.6.Not affected 6.12.39 through 6.12.Not affected 6.15.7 through 6.15.Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before c5496ee685c48ed1cc183cd4263602579bb4a615Affected
c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 80d7dc15805a93d520a249ac6d13d4f4df161c1bAffected
c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 5752d8dbb3dfd7f1a9faf0f65377e60826ea9a17Affected
c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 401239811fa728fcdd53e360a91f157ffd23e1f4Affected
c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 3734d78210cceb2ee5615719a62a5c55ed381ff8Affected
c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 6a1bcab67bea797d83aa9dd948a0ac6ed52d121dAffected
c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 209fd720838aaf1420416494c5505096478156b4Affected

LinuxLinux

5.5Affected
before 5.5Not affected
5.10.240 through 5.10.*Not affected
5.15.189 through 5.15.*Not affected
6.1.146 through 6.1.*Not affected
6.6.99 through 6.6.*Not affected
6.12.39 through 6.12.*Not affected
6.15.7 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.