Concurrency Vulnerability in Linux Kernel vsock Transport Mechanism

CVE-2025-38461

What is CVE-2025-38461?

A concurrency vulnerability exists in the Linux kernel's vsock transport mechanism, where a race condition may occur during transport assignments. This situation arises when a transport assignment conflicts with module unloading, potentially leading to a stale pointer. Additionally, an insecure function call in the vsock_use_local_transport() leads to a page fault. The vulnerability highlights the importance of proper locking mechanisms to prevent such race conditions and ensures the reliability of kernel operations.

References