CVE-2025-38462

MediumCVSS 4.7/10Last modified Nov 5, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

vsock: Fix transport_{g2h,h2g} TOCTOU

vsock_find_cid() and vsock_dev_do_ioctl() may race with module unload. transport_{g2h,h2g} may become NULL after the NULL check.

Introduce vsock_transport_local_cid() to protect from a potential null-ptr-deref.

KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] RIP: 0010:vsock_find_cid+0x47/0x90 Call Trace: __vsock_bind+0x4b2/0x720 vsock_bind+0x90/0xe0 __sys_bind+0x14d/0x1e0 __x64_sys_bind+0x6e/0xc0 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53

KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] RIP: 0010:vsock_dev_do_ioctl.isra.0+0x58/0xf0 Call Trace: __x64_sys_ioctl+0x12d/0x190 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-367

Affected software

VendorProductVersions
LinuxLinux>= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a, < c5496ee685c48ed1cc183cd4263602579bb4a615; >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a, < 80d7dc15805a93d520a249ac6d13d4f4df161c1b; >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a, < 5752d8dbb3dfd7f1a9faf0f65377e60826ea9a17; >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a, < 401239811fa728fcdd53e360a91f157ffd23e1f4; >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a, < 3734d78210cceb2ee5615719a62a5c55ed381ff8; >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a, < 6a1bcab67bea797d83aa9dd948a0ac6ed52d121d; >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a, < 209fd720838aaf1420416494c5505096478156b4
LinuxLinux5.5

References

Timeline

Published
Jul 25, 2025
Last modified
Nov 5, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-384635.5In the Linux kernel, the following vulnerability has been resolved: tcp: Correct signedness in skb remaining space calculation Syzkaller rCVE-2025-384647.8In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_conn_close(). syzbot reported a null-CVE-2025-384655.5In the Linux kernel, the following vulnerability has been resolved: netlink: Fix wraparounds of sk->sk_rmem_alloc. Netlink has this patterCVE-2025-384665.5In the Linux kernel, the following vulnerability has been resolved: perf: Revert to requiring CAP_SYS_ADMIN for uprobes Jann reports that CVE-2025-384675.5In the Linux kernel, the following vulnerability has been resolved: drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling If theCVE-2025-384685.5In the Linux kernel, the following vulnerability has been resolved: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree CVE-2025-384695.5In the Linux kernel, the following vulnerability has been resolved: KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercCVE-2025-38479.8A vulnerability classified as critical has been found in markparticle WebServer up to 1.0. This affects an unknown part of the file code/httCVE-2025-384705.5In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during rCVE-2025-384717.8In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes iCVE-2025-384725.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: fix crash due to removal of uninitialised entrCVE-2025-384735.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() syzbot reporte
CVE-2025-38462: Medium severity, CVSS 4.7 | Vulnix