CVE-2025-38524

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix recv-recv race of completed call

If a call receives an event (such as incoming data), the call gets placed

on the socket's queue and a thread in recvmsg can be awakened to go and

process it. Once the thread has picked up the call off of the queue,

further events will cause it to be requeued, and once the socket lock is

dropped (recvmsg uses call->user_mutex to allow the socket to be used in

parallel), a second thread can come in and its recvmsg can pop the call off

the socket queue again.

In such a case, the first thread will be receiving stuff from the call and

the second thread will be blocked on call->user_mutex. The first thread

can, at this point, process both the event that it picked call for and the

event that the second thread picked the call for and may see the call

terminate - in which case the call will be "released", decoupling the call

from the user call ID assigned to it (RXRPC_USER_CALL_I

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References