linux-cve-announce - CVE-2025-38524: rxrpc: Fix recv-recv race of completed call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025081653-CVE-2025-38524-7277@gregkh>
Date: Sat, 16 Aug 2025 13:13:55 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38524: rxrpc: Fix recv-recv race of completed call

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix recv-recv race of completed call

If a call receives an event (such as incoming data), the call gets placed
on the socket's queue and a thread in recvmsg can be awakened to go and
process it.  Once the thread has picked up the call off of the queue,
further events will cause it to be requeued, and once the socket lock is
dropped (recvmsg uses call->user_mutex to allow the socket to be used in
parallel), a second thread can come in and its recvmsg can pop the call off
the socket queue again.

In such a case, the first thread will be receiving stuff from the call and
the second thread will be blocked on call->user_mutex.  The first thread
can, at this point, process both the event that it picked call for and the
event that the second thread picked the call for and may see the call
terminate - in which case the call will be "released", decoupling the call
from the user call ID assigned to it (RXRPC_USER_CALL_ID in the control
message).

The first thread will return okay, but then the second thread will wake up
holding the user_mutex and, if it sees that the call has been released by
the first thread, it will BUG thusly:

	kernel BUG at net/rxrpc/recvmsg.c:474!

Fix this by just dequeuing the call and ignoring it if it is seen to be
already released.  We can't tell userspace about it anyway as the user call
ID has become stale.

The Linux kernel CVE team has assigned CVE-2025-38524 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 4.9 with commit 248f219cb8bcbfbd7f132752d44afa2df7c241d1 and fixed in 6.6.100 with commit 7692bde890061797f3dece0148d7859e85c55778
	Issue introduced in 4.9 with commit 248f219cb8bcbfbd7f132752d44afa2df7c241d1 and fixed in 6.12.40 with commit 839fe96c15209dc2255c064bb44b636efe04f032
	Issue introduced in 4.9 with commit 248f219cb8bcbfbd7f132752d44afa2df7c241d1 and fixed in 6.15.8 with commit 6c75a97a32a5fa2060c3dd30207e63b6914b606d
	Issue introduced in 4.9 with commit 248f219cb8bcbfbd7f132752d44afa2df7c241d1 and fixed in 6.16 with commit 962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38524
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	include/trace/events/rxrpc.h
	net/rxrpc/call_accept.c
	net/rxrpc/recvmsg.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7692bde890061797f3dece0148d7859e85c55778
	https://git.kernel.org/stable/c/839fe96c15209dc2255c064bb44b636efe04f032
	https://git.kernel.org/stable/c/6c75a97a32a5fa2060c3dd30207e63b6914b606d
	https://git.kernel.org/stable/c/962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc