CVE-2025-38727 json
netlink: avoid infinite retry looping in netlink_unicast()
published 2025-09-04 14 mo ago modified 2026-10-19 20 d ago also EUVD-2025-26742
- cvss
- 5.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 7%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
netlink: avoid infinite retry looping in netlink_unicast()
netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has:
rmem < READ_ONCE(sk->sk_rcvbuf)
to check if the just increased rmem value fits into the socket's receive buffer. If not, it proceeds and tries to wait for the memory under:
rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf)
The checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is equal to sk->sk_rcvbuf. Thus the function neither successfully accepts these conditions, nor manages to reschedule the task - and is called in retry loop for indefinite time which is caught as:
rcu: INFO: rcu_sched self-detected stall on CPU rcu: 0-....: (25999 ticks this GP) idle=ef2/1/0x4000000000000000 softirq=262269/262269 fqs=6212 (t=26000 jiffies g=230833 q=259957) NMI backtrace for cpu 0 CPU: 0 PID: 22 Comm: kauditd Not tainted 5.10.240 #68 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc42 04/01/2014 Call Trace: <IRQ> dump_stack lib/dump_stack.c:120 nmi_cpu_backtrace.cold lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace lib/nmi_backtrace.c:62 rcu_dump_cpu_stacks kernel/rcu/tree_stall.h:335 rcu_sched_clock_irq.cold kernel/rcu/tree.c:2590 update_process_times kernel/time/timer.c:1953 tick_sched_handle kernel/time/tick-sched.c:227 tick_sched_timer kernel/time/tick-sched.c:1399 __hrtimer_run_queues kernel/time/hrtimer.c:1652 hrtimer_interrupt kernel/time/hrtimer.c:1717 __sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1113 asm_call_irq_on_stack arch/x86/entry/entry_64.S:808 </IRQ>
netlink_attachskb net/netlink/af_netlink.c:1234 netlink_unicast net/netlink/af_netlink.c:1349 kauditd_send_queue kernel/audit.c:776 kauditd_thread kernel/audit.c:897 kthread kernel/kthread.c:328 ret_from_fork arch/x86/entry/entry_64.S:304
Restore the original behavior of the check which commit in Fixes accidentally missed when restructuring the code.
Found by Linux Verification Center (linuxtesting.org).
Patch / fix
- Linux Linux 5.4.297, 5.10.241, 5.15.190, 6.1.149, 6.6.103, 6.12.43, 6.15.11, 6.16.2, 6.17
- Siemens SIMATIC CN 4100 V5.0
- linux Debian 12 6.1.153-1
- linux Debian 13 6.12.43-1
- linux Debian 14 6.16.3-1
debian advisories DEBIAN-CVE-2025-38727
- linux Ubuntu 22.04 LTS 5.15.0-160.170
- linux-aws Ubuntu 22.04 LTS 5.15.0-1095.102
- linux-gcp Ubuntu 22.04 LTS 5.15.0-1095.104
- linux-gke Ubuntu 22.04 LTS 5.15.0-1091.97
- linux-ibm Ubuntu 22.04 LTS 5.15.0-1089.92
- linux-kvm Ubuntu 22.04 LTS 5.15.0-1089.94
- linux-azure Ubuntu 22.04 LTS 5.15.0-1098.107
- linux-gkeop Ubuntu 22.04 LTS 5.15.0-1078.86
ubuntu advisories UBUNTU-CVE-2025-38727
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel-rt Linux Micro 6.2 6.12.0-160000.6.1
- kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
- kernel-source SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
- kernel-default SLES 16.0, SLE High Availability Extension 16.0, Linux Micro 6.2 +1 more 6.12.0-160000.6.1
- kernel-default-base SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1.160000.2.4
- kernel-syms SLES 16.0, Linux Micro Extras 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
- kernel-obs-qa SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.6.1
- kernel-kvmsmall SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.6.1
suse advisories SUSE-SU-2025:21074-1SUSE-SU-2025:21139-1SUSE-SU-2026:20560-1SUSE-SU-2025:21179-1SUSE-SU-2025:4141-1SUSE-SU-2025:4132-1
- kernel-rt openSUSE Leap 16.0 6.12.0-160000.6.1
- dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.6.1
- kernel-64kb openSUSE Leap 16.0 6.12.0-160000.6.1
- kernel-syms openSUSE Leap 16.0 6.12.0-160000.6.1
- kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.6.1
- kernel-source openSUSE Leap 16.0 6.12.0-160000.6.1
- kernel-default openSUSE Leap 16.0 6.12.0-160000.6.1
- kernel-kvmsmall openSUSE Leap 16.0 6.12.0-160000.6.1
opensuse advisories openSUSE-SU-2025:20081-1
- git.kernel.org/stable/c/47d49fd07f86d1f55ea1083287303d237e9e0922 commit
- git.kernel.org/stable/c/6bee383ff83352a693d03efdf27cdd80742f71b2 commit
- git.kernel.org/stable/c/f324959ad47e62e3cadaffa65d3cff790fb48529 commit
- git.kernel.org/stable/c/d42b71a34f6b8a2d5c53df81169b03b8d8b5cf4e commit
- git.kernel.org/stable/c/346c820ef5135cf062fa3473da955ef8c5fb6929 commit
- git.kernel.org/stable/c/44ddd7b1ae0b7edb2c832eb16798c827a05e58f0 commit
- git.kernel.org/stable/c/78fcd69d55c5f11d7694c547eca767a1cfd38ec4 commit
- git.kernel.org/stable/c/e8edc7de688791a337c068693f22e8d8b869df71 commit
- git.kernel.org/stable/c/759dfc7d04bab1b0b86113f1164dc1fec192b859 commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-38727 updated cvss 5.5
kernel: netlink: avoid infinite retry looping in netlink_unicast()
-
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 moreaffected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernelnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-26-295-11 updated cvss 5.5
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.7 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.7affected: mitigation, no fix available
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-26-209-04 updated cvss 5.5
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.6 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.6affected: mitigation, no fix available
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-25-162-05 updated cvss 5.5
Siemens SIMATIC S7-1500 CPU family
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.5affected: mitigation, no fix available
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-26-134-10 updated cvss 5.5
Siemens SIMATIC
-
Siemens SIMATIC CN 4100 < 5.0affected: fixed in V5.0 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
Exploit prediction
0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Linux Linux
- Siemens SIMATIC CN 4100
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Classification
- Weakness
-
- CWE-835 Loop with Unreachable Exit Condition
- Technology feeds
References
-
git.kernel.org
/stable/c/47d49fd07f86d1f55ea1083287303d237e9e0922
patch
-
git.kernel.org
/stable/c/6bee383ff83352a693d03efdf27cdd80742f71b2
patch
-
git.kernel.org
/stable/c/f324959ad47e62e3cadaffa65d3cff790fb48529
patch
-
git.kernel.org
/stable/c/d42b71a34f6b8a2d5c53df81169b03b8d8b5cf4e
patch
-
git.kernel.org
/stable/c/346c820ef5135cf062fa3473da955ef8c5fb6929
patch
-
git.kernel.org
/stable/c/44ddd7b1ae0b7edb2c832eb16798c827a05e58f0
patch
-
git.kernel.org
/stable/c/78fcd69d55c5f11d7694c547eca767a1cfd38ec4
patch
-
git.kernel.org
/stable/c/e8edc7de688791a337c068693f22e8d8b869df71
patch
-
git.kernel.org
/stable/c/759dfc7d04bab1b0b86113f1164dc1fec192b859
patch
-
lists.debian.org
/debian-lts-announce/2025/10/msg00008.html
mailing-list, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2025/10/msg00007.html
mailing-list, third-party-advisory
- cert-portal.siemens.com /productcert/html/ssa-082556.html
- cert-portal.siemens.com /productcert/html/ssa-032379.html
- cert-portal.siemens.com /productcert/html/ssa-019113.html
- cert-portal.siemens.com /productcert/html/ssa-457936.html
Sources
- CVE List CVE-2025-38727
- NVD CVE-2025-38727
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.