Critical Vulnerability in Linux Kernel: Uninitialized Memory Access in MCTP Implementation
Summary
DEBIAN-CVE-2025-38006: In the Linux kernel, the following vulnerability has been resolved: net: mctp: Don't access ifa_index when missing In mctp_dump_addrinfo, ifa_index can be used to filter interfaces, but only when the struct ifaddrmsg is... Affects linux versions < 6.12.30-1. Fixed in 6.12.30-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its stability, performance, and support for a wide range of hardware architectures. However, it is also susceptible to vulnerabilities that can impact system security and functionality. This specific vulnerability affects the MCTP (Management Component Transport Protocol) implementation within the kernel, which is responsible for managing communication between different components in a system.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the MCTP implementation where the ifa_index can be accessed without proper initialization. This occurs in the mctp_dump_addrinfo function, which is designed to filter interfaces based on the ifa_index value. If the struct ifaddrmsg is not provided, the function compares against uninitialized memory, leading to potential security risks such as information leakage or system instability. This issue can be reproduced in scenarios involving DHCP or when using commands like 'ip addr show'. The bug has been documented as 'BUG: KMSAN: uninit-value in mctp_dump_addrinfo'.
How To Fix
Minimum fixed version
6.12.30-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the MCTP features or ensure that valid ifa_index values are passed when interacting with MCTP addresses. This can help mitigate the risk until the kernel is updated.
Conclusion
The vulnerability in the Linux kernel's MCTP implementation poses significant risks due to uninitialized memory access. It is crucial for users to update their systems to the latest patched version to ensure security and stability. Utilizing tools like Vulert can aid in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to uninitialized memory access, which may result in information leakage or system instability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Consider using the workaround by ensuring valid ifa_index values are passed or temporarily avoiding MCTP features until the update can be applied.
Yes, this vulnerability affects versions prior to 6.12.30-1. Updating to this version or later is necessary to mitigate the risk.
Detailed information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38006.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
