CVE-2025-38006

MediumCVSS 5.5/10Last modified Oct 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: Don't access ifa_index when missing

In mctp_dump_addrinfo, ifa_index can be used to filter interfaces, but only when the struct ifaddrmsg is provided. Otherwise it will be comparing to uninitialised memory - reproducible in the syzkaller case from dhcpd, or busybox "ip addr show".

The kernel MCTP implementation has always filtered by ifa_index, so existing userspace programs expecting to dump MCTP addresses must already be passing a valid ifa_index value (either 0 or a real index).

BUG: KMSAN: uninit-value in mctp_dump_addrinfo+0x208/0xac0 net/mctp/device.c:128 mctp_dump_addrinfo+0x208/0xac0 net/mctp/device.c:128 rtnl_dump_all+0x3ec/0x5b0 net/core/rtnetlink.c:4380 rtnl_dumpit+0xd5/0x2f0 net/core/rtnetlink.c:6824 netlink_dump+0x97b/0x1690 net/netlink/af_netlink.c:2309

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-908

Affected software

VendorProductVersions
LinuxLinux>= 583be982d93479ea3d85091b0fd0b01201ede87d, < 8ef7b3f0db69e2f4a80be351f6aee9a4c2332ef9; >= 583be982d93479ea3d85091b0fd0b01201ede87d, < d22efcd246a7688599eefcf8e5c7985a3854ef5d; >= 583be982d93479ea3d85091b0fd0b01201ede87d, < acab78ae12c7fefb4f3bfe22e00770a5faa42724; >= 583be982d93479ea3d85091b0fd0b01201ede87d, < d4d1561d17eb72908e4489c0900d96e0484fac20; >= 583be982d93479ea3d85091b0fd0b01201ede87d, < 24fa213dffa470166ec014f979f36c6ff44afb45; >= 583be982d93479ea3d85091b0fd0b01201ede87d, < f11cf946c0a92c560a890d68e4775723353599e1
LinuxLinux5.15

References

Timeline

Published
Jun 18, 2025
Last modified
Oct 30, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-380075.5In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Add NULL check in uclogic_input_configured() devm_kaspriCVE-2025-380084.7In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: fix race condition in unaccepted memory handling The paCVE-2025-380095.5In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: disable napi on driver removal A warning on driver removalCVE-2025-38012.4A vulnerability was found in songquanpeng one-api up to 0.6.10. It has been classified as problematic. This affects an unknown part of the cCVE-2025-380105.5In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking The CVE-2025-380115.5In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: csa unmap use uninterruptible lock After process exit to uCVE-2025-380125.5In the Linux kernel, the following vulnerability has been resolved: sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator BPCVE-2025-380137.8In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_reCVE-2025-380145.5In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper The iCVE-2025-380155.5In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc CVE-2025-380165.5In the Linux kernel, the following vulnerability has been resolved: HID: bpf: abort dispatch if device destroyed The current HID bpf impleCVE-2025-380175.5In the Linux kernel, the following vulnerability has been resolved: fs/eventpoll: fix endless busy loop after timeout has expired After co
CVE-2025-38006: Medium severity, CVSS 5.5 | Vulnix