Local Denial of Service Vulnerability in Linux Kernel vsock Transport Module

CVE-2025-38462

What is CVE-2025-38462?

A vulnerability in the Linux kernel’s vsock transport module can lead to potential null pointer dereference issues, causing instability during operations. The functions vsock_find_cid() and vsock_dev_do_ioctl() are prone to racing conditions with module unloads, which may leave critical pointers NULL even after they've been checked, resulting in unexpected behavior or system crashes. The introduction of the vsock_transport_local_cid() function is intended to mitigate this risk, ensuring a reliable handling of local connection identifiers.

References