Skip to main content

Debian Linux CVE-2025-38617

MEDIUM
Race Condition (CWE-362)
2025-08-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Race Condition Debian Debian Linux
4.7
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

The risk assessment presents a significant disconnect between theoretical severity and practical exploitability. The CVSS 3.1 score of 4.7 (Medium) with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H indicates a local-only attack vector requiring non-root privileges and high attack complexity, with availability impact only. However, the EPSS score of 0.01% (0th percentile) suggests the vulnerability has near-zero real-world exploitation probability, likely because achieving the precise timing for the race condition is extremely difficult in practice. The vulnerability is not listed as actively exploited (no KEV status indication), and while patches are readily available from multiple kernel versions and Debian LTS distributions, the technical barriers to reliable exploitation are substantial. This represents a case where the CVSS rating overstates practical risk; organizations should prioritize this after more exploitable vulnerabilities but should apply patches during routine kernel updates.
Exploit ScenarioDerived

An unprivileged local attacker on a multi-user system could repeatedly attempt to trigger the race condition by calling setsockopt() on a packet socket to resize its ring buffer while monitoring network device events in a tight loop. The attacker must achieve precise timing to have packet_notifier() execute during the brief window when po->bind_lock is released in packet_set_ring(), potentially corrupting internal socket state and causing a kernel panic or resource leak. Successful exploitation is inconsistent and difficult to trigger reliably due to the high attack complexity, though persistent attempts in a loop on a system with high network activity or many devices could eventually succeed, resulting in denial of service to the system.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 18, 2026

A race condition exists in the Linux kernel's packet socket implementation between the packet_set_ring() and packet_notifier() functions, where a temporary lock release allows a NETDEV_UP event to be processed while the socket is in an inconsistent state. This vulnerability affects all Linux kernel versions from 2.6.12 onwards and requires local privilege (non-root user) with moderately high attack complexity to exploit, resulting in a denial of service through resource exhaustion or system crash. The EPSS score of 0.01% indicates extremely low real-world exploitation probability despite the availability of patches and detailed technical analysis from Google security research.

RemediationAI

Apply the available kernel patches immediately by upgrading to a patched kernel version provided by your distribution. For Debian systems, apply security updates from the debian-lts-announce channels (October 2025 releases). For other distributions, consult vendor security advisories and apply kernel updates that include commits addressing CVE-2025-38617 (patches are available at git.kernel.org/stable/ with the listed commit hashes). If immediate patching is not feasible, restrict packet socket creation through Linux security modules (AppArmor/SELinux) or seccomp policies to limit which users and processes can invoke socket(AF_PACKET, ...) operations, and consider running untrusted workloads in containers with restricted capabilities. Given the low EPSS score, this can be scheduled as part of regular kernel maintenance rather than as an emergency out-of-band patch.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the net/packet subsystem of the Linux kernel, specifically in the synchronization logic between packet_set_ring() and packet_notifier() functions. The root cause is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), a classic race condition vulnerability. The packet_set_ring() function temporarily releases the po->bind_lock to perform blocking operations (such as memory allocation), creating a window where packet_notifier() can execute and process NETDEV_UP events. During this window, the socket state becomes inconsistent because po->num (which tracks the socket's active status in the notification handler) is not zeroed. This mirrors a previously-patched race condition fixed by commit 15fe076edea7 in packet_bind(). The fix involves temporarily setting po->num to zero while the lock is released, keeping the socket logically unhooked from the notification system until the lock is retaken and the operation completes.

Know when Debian Linux gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 4.1 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Mar 18, 2026 - 17:37 nvd
Patch available
CVE Published
Aug 22, 2025 - 14:15 nvd
MEDIUM 4.7

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net/packet: fix a race in packet_set_ring() and packet_notifier()

When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event.

This race and the fix are both similar to that of commit 15fe076edea7 ("net/packet: fix a race in packet_bind() and packet_notifier()").

There too the packet_notifier NETDEV_UP event managed to run while a po->bind_lock critical section had to be temporarily released. And the fix was similarly to temporarily set po->num to zero to keep the socket unhooked until the lock is retaken.

The po->bind_lock in packet_set_ring and packet_notifier precede the introduction of git history.

Executive ViewAI

Why It Matters

CVE-2025-38617 presents moderate security risk, a race condition vulnerability rated CVSS 4.7. Exploitation could compromise the security of affected deployments. A patch is available and should be applied during regular vulnerability management.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: implement rate limiting and resource quotas.

Threat Intelligence Overview

EPSS Score
0.0%
Top 100% exploitable
Threat Intel
1
1 source
Data Quality
7 sources
Confidence: High
NVD CVE.org EPSS CISA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Low

Priority Score

34
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +24
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

Affected Products (CPE)NVD

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

More in Debian Linux

View all
CVE-2021-44228 CRITICAL POC
10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2017-7494 CRITICAL POC
9.8 May 30

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2022-30333 HIGH POC
7.5 May 09

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2020-1938 CRITICAL POC
9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
CVE-2018-7602 CRITICAL POC
9.8 Jul 19

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2025-39964 MEDIUM POC
5.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-4.42 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.50 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.73 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.85 Affected
Container suse/sl-micro/6.0/toolbox:13.2-9.1 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-209-04
Sources: CISA (public domain)

References

Advisories & patches
PATCH https://git.kernel.org/stable/c/01d3c8417b9c1b884a8a981a3b886da556512f36 PATCH https://git.kernel.org/stable/c/18f13f2a83eb81be349a9757ba2141ff1da9ad73 PATCH https://git.kernel.org/stable/c/7da733f117533e9b2ebbd530a22ae4028713955c PATCH https://git.kernel.org/stable/c/7de07705007c7e34995a5599aaab1d23e762d7ca PATCH https://git.kernel.org/stable/c/88caf46db8239e6471413d28aabaa6b8bd552805 PATCH https://git.kernel.org/stable/c/ba2257034755ae773722f15f4c3ad1dcdad15ca9 PATCH https://git.kernel.org/stable/c/e50ccfaca9e3c671cae917dcb994831a859cf588 PATCH https://git.kernel.org/stable/c/f1791fd7b845bea0ce9674fcf2febee7bc87a893 PATCH https://git.kernel.org/stable/c/f2e8fcfd2b1bc754920108b7f2cd75082c5a18df ADVISORY http://chromereleases.googleblog.com/2026/04/long-term-support-channel-update-for_17.html ADVISORY https://vuldb.com/vuln/321044 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03204/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03272/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03283/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03290/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03301/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03310/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03314/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03344/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03382/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03383/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03384/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03602/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03633/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03634/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20653/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20669/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20739/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20756/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20939/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20940/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20942/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20943/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20944/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20945/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20946/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20947/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20950/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20951/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20952/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20953/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20955/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20956/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20957/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20959/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20960/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20973/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20974/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20975/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20977/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20978/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20980/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20981/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20982/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20983/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20984/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20985/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20987/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20988/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20989/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20991/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20994/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20996/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21074/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21139/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21179/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3878/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3880/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3886/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3892/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3927/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3932/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3935/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3936/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3983/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3995/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4000/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4001/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4016/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4024/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4031/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4036/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4040/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4043/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4046/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4050/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4056/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4058/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4059/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4062/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4064/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4078/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4123/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4315/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0170/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20149/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20164/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20169/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20310/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20331/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20560/ REF https://blog.calif.io/p/a-race-within-a-race-exploiting-cve REF https://github.com/google/security-research/pull/339 REF https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html REF https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy