CVE-2025-38544

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix bug due to prealloc collision

When userspace is using AF_RXRPC to provide a server, it has to preallocate

incoming calls and assign to them call IDs that will be used to thread

related recvmsg() and sendmsg() together. The preallocated call IDs will

automatically be attached to calls as they come in until the pool is empty.

To the kernel, the call IDs are just arbitrary numbers, but userspace can

use the call ID to hold a pointer to prepared structs. In any case, the

user isn't permitted to create two calls with the same call ID (call IDs

become available again when the call ends) and EBADSLT should result from

sendmsg() if an attempt is made to preallocate a call with an in-use call

ID.

However, the cleanup in the error handling will trigger both assertions in

rxrpc_cleanup_call() because the call isn't marked complete and isn't

marked as having been released.

Fix this by setting the call state in rx

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References