CVE-2025-38461

vsock: Fix transport_* TOCTOU

published July 25, 2025

CVSS
—
EPSS
0%
Percentile
2.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

vsock: Fix transport_* TOCTOU

Transport assignment may race with module unload. Protect new_transport

from becoming a stale pointer.

This also takes care of an insecure call in vsock_use_local_transport();

add a lockdep assert.

BUG: unable to handle page fault for address: fffffbfff8056000

Oops: Oops: 0000 [#1] SMP KASAN

RIP: 0010:vsock_assign_transport+0x366/0x600

Call Trace:

vsock_connect+0x59c/0xc40

__sys_connect+0xe8/0x100

__x64_sys_connect+0x6e/0xc0

do_syscall_64+0x92/0x1c0

entry_SYSCALL_64_after_hwframe+0x4b/0x53

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00133 · 2.5th percentile
Published
2025-07-25T15:27Z
EPSS history
Timeline
  • 25 JUL 15:27Z
    vsock: Fix transport_* TOCTOU
    cvelistv5