Race Condition Vulnerability in Linux Kernel's KCM Module
Summary
CVE-2025-38717: In the Linux kernel, the following vulnerability has been resolved: net: kcm: Fix race condition in kcm_unattach() syzbot found a race condition when kcm_unattach(psock) and kcm_release(kcm) are executed at the same time... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and flexibility, supporting a wide range of hardware architectures. The kernel's KCM (Kernel Connection Multiplexer) module is designed to manage multiple connections efficiently. However, it is susceptible to a race condition vulnerability that can lead to system instability.
Vulnerability Detail
In the Linux kernel, a race condition was identified in the KCM module, specifically in the functions kcm_unattach() and kcm_release(). This vulnerability arises when both functions are executed simultaneously, leading to potential memory corruption. The lack of a check for the kcm->tx_stopped flag before calling queue_work() allows kcm_unattach() to execute at an inappropriate time, risking the integrity of the kernel and potentially causing system crashes or data loss.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. It is advisable to monitor the system and apply the patch as soon as it becomes available.
Conclusion
The race condition vulnerability in the Linux kernel's KCM module poses significant risks to system stability and security. It is essential for users to update their systems to the patched versions to mitigate these risks. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
A race condition occurs when two or more processes access shared data and try to change it at the same time. This can lead to unpredictable results and system instability.
If exploited, this vulnerability can lead to memory corruption, system crashes, or data loss, impacting the overall stability and security of your system.
Versions of the Linux kernel prior to the patched versions (6.12.43-1 for Debian 13 and 6.16.3-1 for Debian 14) are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file, you can check for vulnerabilities without needing to install any software.
While there are no specific workarounds available, it is crucial to monitor your system for unusual behavior and apply the patch as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
