CVE-2025-38727

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netlink: avoid infinite retry looping in netlink_unicast()

netlink_attachskb() checks for the socket's read memory allocation

constraints. Firstly, it has:

rmem < READ_ONCE(sk->sk_rcvbuf)

to check if the just increased rmem value fits into the socket's receive

buffer. If not, it proceeds and tries to wait for the memory under:

rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf)

The checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is

equal to sk->sk_rcvbuf. Thus the function neither successfully accepts

these conditions, nor manages to reschedule the task - and is called in

retry loop for indefinite time which is caught as:

rcu: INFO: rcu_sched self-detected stall on CPU

rcu: 0-....: (25999 ticks this GP) idle=ef2/1/0x4000000000000000 softirq=262269/262269 fqs=6212

(t=26000 jiffies g=230833 q=259957)

NMI backtrace for cpu 0

CPU: 0 PID: 22 Comm: kauditd Not tainted 5.10.240 #68

Ha

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References