CVE-2025-38638 in Linux
Summary
by MITRE • 08/22/2025
In the Linux kernel, the following vulnerability has been resolved:
ipv6: add a retry logic in net6_rt_notify()
inet6_rt_notify() can be called under RCU protection only. This means the route could be changed concurrently and rt6_fill_node() could return -EMSGSIZE.
Re-size the skb when this happens and retry, removing one WARN_ON() that syzbot was able to trigger:
WARNING: CPU: 3 PID: 6291 at net/ipv6/route.c:6342 inet6_rt_notify+0x475/0x4b0 net/ipv6/route.c:6342 Modules linked in: CPU: 3 UID: 0 PID: 6291 Comm: syz.0.77 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:inet6_rt_notify+0x475/0x4b0 net/ipv6/route.c:6342 Code: fc ff ff e8 6d 52 ea f7 e9 47 fc ff ff 48 8b 7c 24 08 4c 89 04 24 e8 5a 52 ea f7 4c 8b 04 24 e9 94 fd ff ff e8 9c fe 84 f7 90 <0f> 0b 90 e9 bd fd ff ff e8 6e 52 ea f7 e9 bb fb ff ff 48 89 df e8 RSP: 0018:ffffc900035cf1d8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffc900035cf540 RCX: ffffffff8a36e790 RDX: ffff88802f7e8000 RSI: ffffffff8a36e9d4 RDI: 0000000000000005 RBP: ffff88803c230f00 R08: 0000000000000005 R09: 00000000ffffffa6 R10: 00000000ffffffa6 R11: 0000000000000001 R12: 00000000ffffffa6 R13: 0000000000000900 R14: ffff888032ea4100 R15: 0000000000000000 FS: 00007fac7b89a6c0(0000) GS:ffff8880d6a20000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fac7b899f98 CR3: 0000000034b3f000 CR4: 0000000000352ef0 Call Trace: <TASK> ip6_route_mpath_notify+0xde/0x280 net/ipv6/route.c:5356 ip6_route_multipath_add+0x1181/0x1bd0 net/ipv6/route.c:5536 inet6_rtm_newroute+0xe4/0x1a0 net/ipv6/route.c:5647 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:6944 netlink_rcv_skb+0x155/0x420 net/netlink/af_netlink.c:2552 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x58d/0x850 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg net/socket.c:727 [inline]
____sys_sendmsg+0xa95/0xc70 net/socket.c:2566 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/28/2026
The vulnerability identified as CVE-2025-38638 resides within the Linux kernel's IPv6 routing subsystem, specifically in the `net6_rt_notify()` function. This flaw manifests when the `inet6_rt_notify()` function is invoked under Read-Copy-Update (RCU) protection, a concurrency control mechanism that allows for efficient read operations while permitting modifications to occur in the background. Under such conditions, route table entries may be modified concurrently, leading to potential inconsistencies and errors during route notification processing. The root cause of the issue lies in the handling of buffer sizes when populating routing information, particularly in the `rt6_fill_node()` function which may return an `-EMSGSIZE` error when the allocated socket buffer (skb) is insufficient to accommodate the route data being processed.
The operational impact of this vulnerability is significant as it can lead to system instability and potential denial of service conditions. The error condition occurs during IPv6 route management operations, particularly when multipath routing is involved, as indicated by the call trace showing `ip6_route_mpath_notify()` and `ip6_route_multipath_add()` functions. The syzbot fuzzing tool was able to trigger a warning condition that manifests as a kernel oops, specifically a `WARN_ON()` failure in the `inet6_rt_notify()` function at line 6342 of the route.c file. This warning occurs when the system attempts to fill routing node information but encounters a buffer size constraint that was not previously handled gracefully. The vulnerability demonstrates a lack of proper error recovery mechanisms, particularly in scenarios where concurrent modifications to the routing table occur under RCU protection.
The fix implemented addresses the core issue by introducing retry logic within the `net6_rt_notify()` function. When `rt6_fill_node()` returns `-EMSGSIZE`, the system now resizes the socket buffer and retries the operation rather than immediately failing or triggering a warning. This approach aligns with standard kernel development practices for handling buffer overflow conditions and concurrent modification scenarios. The mitigation strategy removes the problematic `WARN_ON()` statement that was causing system instability, replacing it with a more robust error handling mechanism that can gracefully accommodate dynamic routing table changes. This solution follows established patterns for handling RCU-protected data structures and aligns with the principles of defensive programming in kernel space. The fix ensures that IPv6 routing operations remain stable even when concurrent modifications occur, preventing potential system crashes and maintaining the integrity of the routing subsystem. This vulnerability type is categorized under CWE-691 as "Insufficient Control Flow Management" and can be mapped to ATT&CK technique T1059.006 for kernel-level command execution through system call interfaces, though the specific impact here is more focused on system stability and denial of service rather than privilege escalation.