CVE-2025-38006

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: Don't access ifa_index when missing

In mctp_dump_addrinfo, ifa_index can be used to filter interfaces, but

only when the struct ifaddrmsg is provided. Otherwise it will be

comparing to uninitialised memory - reproducible in the syzkaller case from

dhcpd, or busybox "ip addr show".

The kernel MCTP implementation has always filtered by ifa_index, so

existing userspace programs expecting to dump MCTP addresses must

already be passing a valid ifa_index value (either 0 or a real index).

BUG: KMSAN: uninit-value in mctp_dump_addrinfo+0x208/0xac0 net/mctp/device.c:128

mctp_dump_addrinfo+0x208/0xac0 net/mctp/device.c:128

rtnl_dump_all+0x3ec/0x5b0 net/core/rtnetlink.c:4380

rtnl_dumpit+0xd5/0x2f0 net/core/rtnetlink.c:6824

netlink_dump+0x97b/0x1690 net/netlink/af_netlink.c:2309

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References