CVE-2025-38147 in Linux
Sumário
de VulDB • 01/07/2026
Based on the kernel crash dump provided, here is an analysis of the issue.
### **Summary** The system crashed with a **NULL Pointer Dereference** (or similar invalid memory access) inside the Linux Kernel's NetLabel subsystem while handling a `connect()` syscall from user space. The specific function failing is `calipso_sock_setattr`.
This typically indicates that: 1. A socket was being connected to, and SELinux/NetLabel tried to assign security attributes (Calipso labels). 2. One of the pointers expected by `calipso_sock_setattr` was **NULL** or invalid. 3. This is likely a bug in the kernel code path for Calipso label handling during socket connection, possibly triggered under specific network/SELinux configurations.
---
### **Detailed Call Trace Analysis**
1. **User Space Trigger**: * `__x64_sys_connect` → The user-space application called the `connect()` system call (syscall number `0x2a`). * This initiated a network connection attempt on socket file descriptor `3`.
2. **Security Subsystem Hook**: * `security_socket_connect` → Kernel security framework hook. * `selinux_socket_connect` → SELinux is active and handling the connect event. * `selinux_netlbl_socket_connect` / `selinux_netlbl_socket_connect_locked` → SELinux delegates NetLabel (network labeling) operations to handle Calipso labels.
3. **NetLabel/Calipso Handling**: * `netlbl_conn_setattr` → Sets connection attributes for the socket in NetLabel. * **`calipso_sock_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:557`** ← **CRASH LOCATION**
---
### **Root Cause Analysis**
The crash occurs at `net/netlabel/netlabel_calipso.c:557`. Looking at typical kernel code for this function, it likely dereferences a pointer related to the Calipso protocol options or socket security data.
Common causes in this context include: * **Missing Socket Security Data**: The socket may not have been properly initialized with NetLabel/Calipso security structures before `connect()` was called. * **Race Condition**: A concurrent operation might have freed the Calipso option structure while it was still being accessed. * **Invalid Configuration**: SELinux or NetLabel configuration is inconsistent (e.g., expecting a Calipso label but none exists).
---
### **Recommended Actions**
#### 1. **Immediate Mitigation** If this system must remain online: * **Disable Calipso in SELinux/NetLabel**: If you do not use IPsec or MAC networks with Calipso labels, disable it to prevent the crash. * Check `/etc/selinux/config` and ensure `NETLABEL` is disabled if possible (requires reboot). * Or, temporarily set SELinux to permissive mode: ```bash sudo setenforce 0 ``` * **Update Kernel**: This may be a known bug fixed in newer kernel versions. Check your distribution's security advisories for `netlabel` or `calipso` fixes.
#### 2. **Debugging Steps** To get more details, enable dynamic debugging: ```bash # Enable debug prints for netlabel_calipso.c echo "file net/netlabel/netlabel_calipso.c +p" > /sys/kernel/debug/dynamic_debug/control ``` Then reproduce the issue and check `dmesg` or `/var/log/kern.log`.
#### 3. **Bug Report** If this is a production system with updated kernels, report it to your distribution's bug tracker (e.g., Red Hat Bugzilla, Ubuntu Launchpad) including: * Full kernel version (`uname -r`) * SELinux status and policy version * The full crash dump (this trace + any preceding logs)
---
### **Code Context (Approximate)** In `net/netlabel/netlabel_calipso.c`, around line 557, the code likely does something like: ```c struct calipso_doi *calipso_ptr = ...; // Could be NULL if not initialized if (!calipso_ptr) {
// Missing null check? Or caller failed to set it up properly. } // Crash happens here when dereferencing calipso_ptr or related struct ```
This suggests a **missing NULL pointer check** in the kernel code path, which is a bug that should be fixed upstream.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.