Riskcovery

CVE-2025-38717

net: kcm: Fix race condition in kcm_unattach()

State
Published
Severity
7.8 High
Published
Sep 4, 2025
Updated
Aug 5, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: kcm: Fix race condition in kcm_unattach()

syzbot found a race condition when kcm_unattach(psock) and kcm_release(kcm) are executed at the same time.

kcm_unattach() is missing a check of the flag kcm->tx_stopped before calling queue_work().

If the kcm has a reserved psock, kcm_unattach() might get executed between cancel_work_sync() and unreserve_psock() in kcm_release(), requeuing kcm->tx_work right before kcm gets freed in kcm_done().

Remove kcm->tx_stopped and replace it by the less error-prone disable_work_sync().

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 to before c0bffbc92a1ca3960fb9cdb8e9f75a68468eb308Affected
  • ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 to before 7275dc3bb8f91b23125ff3f47b6529935cf46152Affected
  • ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 to before 798733ee5d5788b12e8a52db1519abc17e826f69Affected
  • ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 to before 52565a935213cd6a8662ddb8efe5b4219343a25dAffected
LinuxLinux
  • 4.6Affected
  • before 4.6Not affected
  • 6.12.43 through 6.12.*Not affected
  • 6.15.11 through 6.15.*Not affected
  • 6.16.2 through 6.16.*Not affected
  • 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.