CVE-2025-38089 (GCVE-0-2025-38089)

Vulnerability from cvelistv5 – Published: 2025-06-30 07:29 – Updated: 2026-08-05 11:59
VLAI
Title
sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
Summary
In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If decoding the RPC reply fails in such a way that SVC_GARBAGE is returned without setting the rq_accept_statp pointer, then that pointer can be dereferenced and a value stored there. If it's the first time the thread has processed an RPC, then that pointer will be set to NULL and the kernel will crash. In other cases, it could create a memory scribble. The server sunrpc code treats a SVC_GARBAGE return from svc_authenticate or pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531 says that if authentication fails that the RPC should be rejected instead with a status of AUTH_ERR. Handle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of AUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This sidesteps the whole problem of touching the rpc_accept_statp pointer in this situation and avoids the crash.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 29cd2927fb914cc53b5ba4f67d2b74695c994ba4 , < 599c489eea793821232a2f69a00fa57d82b0ac98 (git)
Affected: 29cd2927fb914cc53b5ba4f67d2b74695c994ba4 , < 353e75b55e583635bf71cde6abcec274dba05edd (git)
Affected: 29cd2927fb914cc53b5ba4f67d2b74695c994ba4 , < c90459cd58bb421d275337093d8e901e0ba748dd (git)
Affected: 29cd2927fb914cc53b5ba4f67d2b74695c994ba4 , < 94d10a4dba0bc482f2b01e39f06d5513d0f75742 (git)
Affected: 9b59f5c4911e87264507e0934cd2bb277390c560 (git)
Affected: 6.3.4 , < 6.4 (semver)
Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.95 , ≤ 6.6.* (semver)
Unaffected: 6.12.35 , ≤ 6.12.* (semver)
Unaffected: 6.15.4 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:10:10.064Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/02/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "599c489eea793821232a2f69a00fa57d82b0ac98",
              "status": "affected",
              "version": "29cd2927fb914cc53b5ba4f67d2b74695c994ba4",
              "versionType": "git"
            },
            {
              "lessThan": "353e75b55e583635bf71cde6abcec274dba05edd",
              "status": "affected",
              "version": "29cd2927fb914cc53b5ba4f67d2b74695c994ba4",
              "versionType": "git"
            },
            {
              "lessThan": "c90459cd58bb421d275337093d8e901e0ba748dd",
              "status": "affected",
              "version": "29cd2927fb914cc53b5ba4f67d2b74695c994ba4",
              "versionType": "git"
            },
            {
              "lessThan": "94d10a4dba0bc482f2b01e39f06d5513d0f75742",
              "status": "affected",
              "version": "29cd2927fb914cc53b5ba4f67d2b74695c994ba4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b59f5c4911e87264507e0934cd2bb277390c560",
              "versionType": "git"
            },
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "6.3.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: handle SVC_GARBAGE during svc auth processing as auth error\n\ntianshuo han reported a remotely-triggerable crash if the client sends a\nkernel RPC server a specially crafted packet. If decoding the RPC reply\nfails in such a way that SVC_GARBAGE is returned without setting the\nrq_accept_statp pointer, then that pointer can be dereferenced and a\nvalue stored there.\n\nIf it\u0027s the first time the thread has processed an RPC, then that\npointer will be set to NULL and the kernel will crash. In other cases,\nit could create a memory scribble.\n\nThe server sunrpc code treats a SVC_GARBAGE return from svc_authenticate\nor pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531\nsays that if authentication fails that the RPC should be rejected\ninstead with a status of AUTH_ERR.\n\nHandle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of\nAUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This\nsidesteps the whole problem of touching the rpc_accept_statp pointer in\nthis situation and avoids the crash."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the shared kernel RPC server core (net/sunrpc/svc.c) used by nfsd, lockd, and the NFS callback service, and is triggered purely by the bytes of an inbound RPC call arriving on TCP/UDP 2049. Any host that can reach the listening socket, including across the internet, can send the malformed record.\nAC:L - The attacker sends a single truncated RPC message that ends before the credential flavor field; decode failure and the bad store are deterministic, with no race and no memory-layout precondition. Fresh nfsd threads (server start or pool growth) give the NULL-pointer variant reliably, and every other thread yields the write-after-free variant.\nPR:N - The crash occurs inside svc_authenticate() itself, before any credential is decoded and long before svc_set_client()/export checks, so no RPC credential, mount, or account is needed. A bare TCP connect to the RPC port is sufficient.\nUI:N - The server processes the malformed RPC automatically on receipt. No action by any local user or administrator is involved.\nS:U - The faulting store and its consequences are confined to the kernel\u0027s own memory and the RPC service; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - In the stale-pointer case this is a write into a freed and reallocated page, i.e. memory corruption of arbitrary kernel objects that can be groomed into that slot; corrupting a length or index field in a neighboring structure yields subsequent over-reads and disclosure of kernel memory.\nI:H - The vulnerable store writes a 32-bit value into a page that has already been released to the allocator and may hold any kernel object, at an offset the attacker can influence via the previous reply\u0027s verifier length. That is a remote pre-auth write-after-free primitive usable to corrupt pointers, credentials, or control data.\nA:H - The NULL-pointer variant oopses the nfsd kernel thread on the very first malformed RPC a thread sees, and can be repeated to kill the whole thread pool, taking down NFS service entirely (full panic where panic_on_oops is set). The write-after-free variant additionally causes unpredictable crashes in unrelated subsystems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:25.591Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/599c489eea793821232a2f69a00fa57d82b0ac98"
        },
        {
          "url": "https://git.kernel.org/stable/c/353e75b55e583635bf71cde6abcec274dba05edd"
        },
        {
          "url": "https://git.kernel.org/stable/c/c90459cd58bb421d275337093d8e901e0ba748dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/94d10a4dba0bc482f2b01e39f06d5513d0f75742"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2025/07/02/2"
        },
        {
          "url": "https://github.com/keymaker-arch/NFSundown"
        }
      ],
      "title": "sunrpc: handle SVC_GARBAGE during svc auth processing as auth error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38089",
    "datePublished": "2025-06-30T07:29:44.836Z",
    "dateReserved": "2025-04-16T04:51:23.982Z",
    "dateUpdated": "2026-08-05T11:59:25.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38089",
      "date": "2026-08-06",
      "epss": "0.00477",
      "percentile": "0.38724"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:17:29.000Z",
      "cve": "CVE-2025-38089",
      "id": "msrc_CVE-2025-38089",
      "initial_release_date": "2025-06-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "sunrpc: handle SVC_GARBAGE during svc auth processing as auth error",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38089.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38089\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-30T08:15:23.590\",\"lastModified\":\"2026-07-30T06:22:50.017\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsunrpc: handle SVC_GARBAGE during svc auth processing as auth error\\n\\ntianshuo han reported a remotely-triggerable crash if the client sends a\\nkernel RPC server a specially crafted packet. If decoding the RPC reply\\nfails in such a way that SVC_GARBAGE is returned without setting the\\nrq_accept_statp pointer, then that pointer can be dereferenced and a\\nvalue stored there.\\n\\nIf it\u0027s the first time the thread has processed an RPC, then that\\npointer will be set to NULL and the kernel will crash. In other cases,\\nit could create a memory scribble.\\n\\nThe server sunrpc code treats a SVC_GARBAGE return from svc_authenticate\\nor pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531\\nsays that if authentication fails that the RPC should be rejected\\ninstead with a status of AUTH_ERR.\\n\\nHandle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of\\nAUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This\\nsidesteps the whole problem of touching the rpc_accept_statp pointer in\\nthis situation and avoids the crash.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sunrpc: manejo de SVC_GARBAGE durante el procesamiento de autenticaci\u00f3n de servicio como error de autenticaci\u00f3n. Tianshuo Han inform\u00f3 de un fallo que se puede activar de forma remota si el cliente env\u00eda a un servidor RPC del kernel un paquete especialmente manipulado. Si la decodificaci\u00f3n de la respuesta RPC falla de tal manera que se devuelve SVC_GARBAGE sin establecer el puntero rq_accept_statp, se puede desreferenciar ese puntero y almacenar un valor all\u00ed. Si es la primera vez que el hilo procesa una RPC, ese puntero se establecer\u00e1 en NULL y el kernel se bloquear\u00e1. En otros casos, podr\u00eda crear un garabato de memoria. El c\u00f3digo del servidor sunrpc trata una devoluci\u00f3n de SVC_GARBAGE de svc_authenticate o pg_authenticate como si debiera enviar una respuesta GARBAGE_ARGS. El RFC 5531 indica que si la autenticaci\u00f3n falla, la RPC debe rechazarse con un estado de AUTH_ERR. Tratar una devoluci\u00f3n de SVC_GARBAGE como AUTH_ERROR, con el motivo AUTH_BADCRED, en lugar de devolver GARBAGE_ARGS en ese caso. Esto evita el problema de tocar el puntero rpc_accept_statp en esta situaci\u00f3n y evita el bloqueo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sunrpc/svc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"29cd2927fb914cc53b5ba4f67d2b74695c994ba4\",\"lessThan\":\"599c489eea793821232a2f69a00fa57d82b0ac98\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"29cd2927fb914cc53b5ba4f67d2b74695c994ba4\",\"lessThan\":\"353e75b55e583635bf71cde6abcec274dba05edd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"29cd2927fb914cc53b5ba4f67d2b74695c994ba4\",\"lessThan\":\"c90459cd58bb421d275337093d8e901e0ba748dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"29cd2927fb914cc53b5ba4f67d2b74695c994ba4\",\"lessThan\":\"94d10a4dba0bc482f2b01e39f06d5513d0f75742\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b59f5c4911e87264507e0934cd2bb277390c560\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.3.4\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sunrpc/svc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.95\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.35\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.4\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3.4\",\"versionEndExcluding\":\"6.4\",\"matchCriteriaId\":\"A1C4BF07-55E0-4ECE-B2BC-1C398FA64210\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4.1\",\"versionEndExcluding\":\"6.6.95\",\"matchCriteriaId\":\"11910915-534C-47AA-B830-C8FED7561895\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.35\",\"matchCriteriaId\":\"E569FD34-0076-4428-BE17-EECCF867611C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.4\",\"matchCriteriaId\":\"DFD174C5-1AA2-4671-BDDC-1A9FCC753655\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE0B0BF6-0EEF-4FAD-927D-7A0DD77BEE75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"A717BA5B-D535-46A0-A329-A25FE5CEC588\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"89CC80C6-F1EE-4AC7-BD21-DB3217BADE87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"41EACEA1-FB69-4AF2-BC52-D39489858D42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E1C36BE-F9D8-40B6-8281-5B8F9B42322D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D6CAA59-F0EF-4E0B-8C23-EC9535008572\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/353e75b55e583635bf71cde6abcec274dba05edd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/599c489eea793821232a2f69a00fa57d82b0ac98\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/94d10a4dba0bc482f2b01e39f06d5513d0f75742\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c90459cd58bb421d275337093d8e901e0ba748dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/keymaker-arch/NFSundown\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://www.openwall.com/lists/oss-security/2025/07/02/2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/07/02/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-30T08:56:22+00:00",
      "cve": "CVE-2025-38089",
      "id": "CVE-2025-38089",
      "initial_release_date": "2025-06-30T00:00:00+00:00",
      "product_status:fixed": "933",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38089.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-25T00:51:47Z",
      "cve": "CVE-2025-38089",
      "id": "CVE-2025-38089",
      "initial_release_date": "2025-06-30T23:30:54Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "323",
      "product_status:recommended": "602",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38089",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38089.json",
      "version": "51"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.