Linux Kernel Route Notification Vulnerability in IPv6

CVE-2025-38638

What is CVE-2025-38638?

A flaw in the Linux kernel's handling of IPv6 route notifications allows for concurrent modifications which can lead to incorrect route management. The issue arises in the inet6_rt_notify() function where route changes can occur simultaneously under Read-Copy-Update (RCU) conditions, potentially resulting in errors like -EMSGSIZE during execution. The vulnerability has been addressed by implementing a retry logic that resizes the socket buffer when an error occurs. This fix enhances the stability and reliability of IPv6 route changes within the kernel, mitigating the risks associated with concurrent processing.

References