CVE-2025-38717: net: kcm: Fix race condition in kcm_unattach()

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-04 · updated 2026-10-19
Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Fix race condition in kcm_unattach() syzbot found a race condition when kcm_unattach(psock) and kcm_release(kcm) are executed at the same time. kcm_unattach() is missing a check of the flag kcm->tx_stopped before calling queue_work(). If the kcm has a reserved psock, kcm_unattach() might get executed between cancel_work_sync() and unreserve_psock() in kcm_release(), requeuing kcm->tx_work right before kcm gets freed in kcm_done(). Remove kcm->tx_stopped and replace it by the less error-prone disable_work_sync().

Affected products

Linux kernel: from 4.6 before 6.12.43; from 6.13 before 6.15.11; from 6.16 before 6.16.2; 6.17-rc1 — fixed in 6.12.43, 6.15.11, 6.16.2

How to fix

Upgrade to a fixed version: Linux kernel 6.12.43, 6.15.11, 6.16.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-38717 or the next vulnerability affects your stack