Linux Kernel Local Vulnerability in af_packet Module by Vendor

CVE-2025-38150

What is CVE-2025-38150?

A local vulnerability exists within the Linux kernel's af_packet module due to improper handling of context during the modification of multicast lists associated with network devices. Specifically, operations intended to modify the multicast list can lead to a state where a sleeping function is improperly called from an invalid context. This mismanagement occurs when calling PACKET_ADD_MEMBERSHIP on an operations-locked device, potentially resulting in disruptions to network device functionalities such as disabling promiscuous mode or allmulti mode. The vulnerability affects the integrity and stability of network operations, highlighting the necessity for secure management of device states and locking mechanisms.

References