CVE-2025-38102
BaseFortify
Publication date: 2025-07-03
Last updated on: 2025-12-16
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 4.0 (inc) to 5.4.296 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.240 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.186 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.142 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.94 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.34 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.15.3 (exc) |
| debian | debian_linux | 11.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a race condition in the Linux kernel's VMCI (Virtual Machine Communication Interface) subsystem. It occurs between the functions vmci_host_setup_notify and vmci_ctx_unset_notify. Specifically, the issue arises because get_user_pages_fast, which initializes a notify_page, is not finished before vmci_ctx_unset_notify tries to free that page with put_page. This leads to a warning in try_grab_folio due to accessing a page that may have been freed prematurely. The fix involves using a local variable to ensure notify_page is only accessed after get_user_pages_fast completes.
How can this vulnerability impact me? :
This race condition can cause warnings and potential instability in the kernel when accessing memory pages, possibly leading to kernel crashes or undefined behavior. While the description does not explicitly mention security impacts like privilege escalation or data corruption, such race conditions can undermine system reliability and security.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for warnings related to try_grab_folio in the Linux kernel, specifically messages like: WARNING: CPU: ... at mm/gup.c:147 try_grab_folio+0x106/0x130. You can check the kernel logs using commands such as 'dmesg | grep try_grab_folio' or 'journalctl -k | grep try_grab_folio' to identify if the warning appears.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the race condition between vmci_host_setup_notify and vmci_ctx_unset_notify is fixed. The fix involves using a local variable to ensure notify_page is properly handled after get_user_pages_fast completes, preventing the race condition and warning. Until the update is applied, monitoring for the warning and avoiding workloads that trigger this race condition may reduce risk.