GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38525 (GCVE-0-2025-38525)

Vulnerability from cvelistv5 – Published: 2025-08-16 11:12 – Updated: 2026-08-10 12:10
VLAI
Title
rxrpc: Fix irq-disabled in local_bh_enable()
Summary
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix irq-disabled in local_bh_enable() The rxrpc_assess_MTU_size() function calls down into the IP layer to find out the MTU size for a route. When accepting an incoming call, this is called from rxrpc_new_incoming_call() which holds interrupts disabled across the code that calls down to it. Unfortunately, the IP layer uses local_bh_enable() which, config dependent, throws a warning if IRQs are enabled: WARNING: CPU: 1 PID: 5544 at kernel/softirq.c:387 __local_bh_enable_ip+0x43/0xd0 ... RIP: 0010:__local_bh_enable_ip+0x43/0xd0 ... Call Trace: <TASK> rt_cache_route+0x7e/0xa0 rt_set_nexthop.isra.0+0x3b3/0x3f0 __mkroute_output+0x43a/0x460 ip_route_output_key_hash+0xf7/0x140 ip_route_output_flow+0x1b/0x90 rxrpc_assess_MTU_size.isra.0+0x2a0/0x590 rxrpc_new_incoming_peer+0x46/0x120 rxrpc_alloc_incoming_call+0x1b1/0x400 rxrpc_new_incoming_call+0x1da/0x5e0 rxrpc_input_packet+0x827/0x900 rxrpc_io_thread+0x403/0xb60 kthread+0x2f7/0x310 ret_from_fork+0x2a/0x230 ret_from_fork_asm+0x1a/0x30 ... hardirqs last enabled at (23): _raw_spin_unlock_irq+0x24/0x50 hardirqs last disabled at (24): _raw_read_lock_irq+0x17/0x70 softirqs last enabled at (0): copy_process+0xc61/0x2730 softirqs last disabled at (25): rt_add_uncached_list+0x3c/0x90 Fix this by moving the call to rxrpc_assess_MTU_size() out of rxrpc_init_peer() and further up the stack where it can be done without interrupts disabled. It shouldn't be a problem for rxrpc_new_incoming_call() to do it after the locks are dropped as pmtud is going to be performed by the I/O thread - and we're in the I/O thread at this point.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 77433b730970ca6e51d03016e830d8ab1b22685a , < d94b82d452ca27a200cd67660dc48476386651d8 (git)
Affected: 09c59a82298f424f6212c67fbea531853e88ce6c , < 8ac0b3baa7d8f732bd9e5cbf1d8b57e4802c6b36 (git)
Affected: a2ea9a9072607c2fd6442bd1ffb4dbdbf882aed7 , < 2029f21f10dedb88c0f86abffcf8d6c21dcf6040 (git)
Affected: a2ea9a9072607c2fd6442bd1ffb4dbdbf882aed7 , < e4d2878369d590bf8455e3678a644e503172eafa (git)
Affected: 6.6.148 , < 6.6.151 (semver)
Affected: 6.12.101 , < 6.12.103 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.15.8 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/ar-internal.h",
            "net/rxrpc/call_accept.c",
            "net/rxrpc/peer_object.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d94b82d452ca27a200cd67660dc48476386651d8",
              "status": "affected",
              "version": "77433b730970ca6e51d03016e830d8ab1b22685a",
              "versionType": "git"
            },
            {
              "lessThan": "8ac0b3baa7d8f732bd9e5cbf1d8b57e4802c6b36",
              "status": "affected",
              "version": "09c59a82298f424f6212c67fbea531853e88ce6c",
              "versionType": "git"
            },
            {
              "lessThan": "2029f21f10dedb88c0f86abffcf8d6c21dcf6040",
              "status": "affected",
              "version": "a2ea9a9072607c2fd6442bd1ffb4dbdbf882aed7",
              "versionType": "git"
            },
            {
              "lessThan": "e4d2878369d590bf8455e3678a644e503172eafa",
              "status": "affected",
              "version": "a2ea9a9072607c2fd6442bd1ffb4dbdbf882aed7",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.151",
              "status": "affected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.103",
              "status": "affected",
              "version": "6.12.101",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/ar-internal.h",
            "net/rxrpc/call_accept.c",
            "net/rxrpc/peer_object.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.6.148",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.12.101",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix irq-disabled in local_bh_enable()\n\nThe rxrpc_assess_MTU_size() function calls down into the IP layer to find\nout the MTU size for a route.  When accepting an incoming call, this is\ncalled from rxrpc_new_incoming_call() which holds interrupts disabled\nacross the code that calls down to it.  Unfortunately, the IP layer uses\nlocal_bh_enable() which, config dependent, throws a warning if IRQs are\nenabled:\n\nWARNING: CPU: 1 PID: 5544 at kernel/softirq.c:387 __local_bh_enable_ip+0x43/0xd0\n...\nRIP: 0010:__local_bh_enable_ip+0x43/0xd0\n...\nCall Trace:\n \u003cTASK\u003e\n rt_cache_route+0x7e/0xa0\n rt_set_nexthop.isra.0+0x3b3/0x3f0\n __mkroute_output+0x43a/0x460\n ip_route_output_key_hash+0xf7/0x140\n ip_route_output_flow+0x1b/0x90\n rxrpc_assess_MTU_size.isra.0+0x2a0/0x590\n rxrpc_new_incoming_peer+0x46/0x120\n rxrpc_alloc_incoming_call+0x1b1/0x400\n rxrpc_new_incoming_call+0x1da/0x5e0\n rxrpc_input_packet+0x827/0x900\n rxrpc_io_thread+0x403/0xb60\n kthread+0x2f7/0x310\n ret_from_fork+0x2a/0x230\n ret_from_fork_asm+0x1a/0x30\n...\nhardirqs last  enabled at (23): _raw_spin_unlock_irq+0x24/0x50\nhardirqs last disabled at (24): _raw_read_lock_irq+0x17/0x70\nsoftirqs last  enabled at (0): copy_process+0xc61/0x2730\nsoftirqs last disabled at (25): rt_add_uncached_list+0x3c/0x90\n\nFix this by moving the call to rxrpc_assess_MTU_size() out of\nrxrpc_init_peer() and further up the stack where it can be done without\ninterrupts disabled.\n\nIt shouldn\u0027t be a problem for rxrpc_new_incoming_call() to do it after the\nlocks are dropped as pmtud is going to be performed by the I/O thread - and\nwe\u0027re in the I/O thread at this point."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is entered directly from `rxrpc_encap_rcv()`/`rxrpc_input_packet()` when an rxrpc DATA packet arrives over UDP from an unknown peer, and kAFS binds its callback-manager service socket to `in6addr_any:7001`, so any routable remote host can reach it.\nAC:L - The attacker fully controls every precondition \u2014 a single crafted rxrpc DATA packet (`callNumber != 0`, `seq == 1`, matching serviceId) from a source port not yet in the peer hash deterministically forces new-peer creation and the MTU assessment under `read_lock_irq()`; no memory layout, timing, or victim state is involved.\nPR:N - `rxrpc_new_incoming_call()` runs entirely before any rxrpc authentication \u2014 the CHALLENGE/RESPONSE handshake is only queued after the call is made live, and `rxrpc_get_incoming_security()` merely validates that the security index is supported, so an unauthenticated off-path attacker suffices.\nUI:N - The AFS/rxrpc service socket is already bound and listening as soon as AFS is in use; processing of the attacker\u0027s packet happens autonomously in the rxrpc I/O kernel thread with no victim action.\nS:U - The fault and its effects are confined to the kernel\u0027s own security authority on the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is purely a locking/IRQ-context violation with no out-of-bounds read, use-after-free, or uninitialised data exposure; nothing is leaked to the remote attacker, who cannot observe the kernel log.\nI:N - No memory is corrupted and no attacker-controlled data is written out of bounds \u2014 the peer backlog ring update completes before the offending call, so there is no write primitive or state modification available.\nA:H - `lockdep_assert_irqs_enabled()` WARNs on `CONFIG_PROVE_LOCKING` kernels, which is a hard panic under the widely deployed `panic_on_warn=1`; independently of that config, `do_softirq()`/`handle_softirqs()` re-enables hardirqs and burns up to 2 ms \u00d7 10 restarts of softirq work inside the `read_lock_irq()` + `spin_lock()` section, stalling the rxrpc I/O thread \u2014 and the whole sequence is remotely repeatable at packet rate by rotating source ports."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T12:10:47.387Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d94b82d452ca27a200cd67660dc48476386651d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ac0b3baa7d8f732bd9e5cbf1d8b57e4802c6b36"
        },
        {
          "url": "https://git.kernel.org/stable/c/2029f21f10dedb88c0f86abffcf8d6c21dcf6040"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4d2878369d590bf8455e3678a644e503172eafa"
        }
      ],
      "title": "rxrpc: Fix irq-disabled in local_bh_enable()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38525",
    "datePublished": "2025-08-16T11:12:19.191Z",
    "dateReserved": "2025-04-16T04:51:24.023Z",
    "dateUpdated": "2026-08-10T12:10:47.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38525",
      "date": "2026-09-16",
      "epss": "0.00364",
      "percentile": "0.30054"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38525\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-16T12:15:27.933\",\"lastModified\":\"2026-08-10T13:17:21.113\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: Fix irq-disabled in local_bh_enable()\\n\\nThe rxrpc_assess_MTU_size() function calls down into the IP layer to find\\nout the MTU size for a route.  When accepting an incoming call, this is\\ncalled from rxrpc_new_incoming_call() which holds interrupts disabled\\nacross the code that calls down to it.  Unfortunately, the IP layer uses\\nlocal_bh_enable() which, config dependent, throws a warning if IRQs are\\nenabled:\\n\\nWARNING: CPU: 1 PID: 5544 at kernel/softirq.c:387 __local_bh_enable_ip+0x43/0xd0\\n...\\nRIP: 0010:__local_bh_enable_ip+0x43/0xd0\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n rt_cache_route+0x7e/0xa0\\n rt_set_nexthop.isra.0+0x3b3/0x3f0\\n __mkroute_output+0x43a/0x460\\n ip_route_output_key_hash+0xf7/0x140\\n ip_route_output_flow+0x1b/0x90\\n rxrpc_assess_MTU_size.isra.0+0x2a0/0x590\\n rxrpc_new_incoming_peer+0x46/0x120\\n rxrpc_alloc_incoming_call+0x1b1/0x400\\n rxrpc_new_incoming_call+0x1da/0x5e0\\n rxrpc_input_packet+0x827/0x900\\n rxrpc_io_thread+0x403/0xb60\\n kthread+0x2f7/0x310\\n ret_from_fork+0x2a/0x230\\n ret_from_fork_asm+0x1a/0x30\\n...\\nhardirqs last  enabled at (23): _raw_spin_unlock_irq+0x24/0x50\\nhardirqs last disabled at (24): _raw_read_lock_irq+0x17/0x70\\nsoftirqs last  enabled at (0): copy_process+0xc61/0x2730\\nsoftirqs last disabled at (25): rt_add_uncached_list+0x3c/0x90\\n\\nFix this by moving the call to rxrpc_assess_MTU_size() out of\\nrxrpc_init_peer() and further up the stack where it can be done without\\ninterrupts disabled.\\n\\nIt shouldn\u0027t be a problem for rxrpc_new_incoming_call() to do it after the\\nlocks are dropped as pmtud is going to be performed by the I/O thread - and\\nwe\u0027re in the I/O thread at this point.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rxrpc: Se corrige la inhabilitaci\u00f3n de irq en local_bh_enable(). La funci\u00f3n rxrpc_assess_MTU_size() realiza una llamada a la capa IP para determinar el tama\u00f1o de MTU de una ruta. Al aceptar una llamada entrante, se realiza una llamada desde rxrpc_new_incoming_call(), que mantiene las interrupciones deshabilitadas en el c\u00f3digo que la realiza. Desafortunadamente, la capa IP usa local_bh_enable() que, dependiendo de la configuraci\u00f3n, lanza una advertencia si las IRQ est\u00e1n habilitadas: WARNING: CPU: 1 PID: 5544 at kernel/softirq.c:387 __local_bh_enable_ip+0x43/0xd0 ... RIP: 0010:__local_bh_enable_ip+0x43/0xd0 ... Call Trace:  rt_cache_route+0x7e/0xa0 rt_set_nexthop.isra.0+0x3b3/0x3f0 __mkroute_output+0x43a/0x460 ip_route_output_key_hash+0xf7/0x140 ip_route_output_flow+0x1b/0x90 rxrpc_assess_MTU_size.isra.0+0x2a0/0x590 rxrpc_new_incoming_peer+0x46/0x120 rxrpc_alloc_incoming_call+0x1b1/0x400 rxrpc_new_incoming_call+0x1da/0x5e0 rxrpc_input_packet+0x827/0x900 rxrpc_io_thread+0x403/0xb60 kthread+0x2f7/0x310 ret_from_fork+0x2a/0x230 ret_from_fork_asm+0x1a/0x30 ... hardirqs last enabled at (23): _raw_spin_unlock_irq+0x24/0x50 hardirqs last disabled at (24): _raw_read_lock_irq+0x17/0x70 softirqs last enabled at (0): copy_process+0xc61/0x2730 softirqs last disabled at (25): rt_add_uncached_list+0x3c/0x90. Para solucionar esto, mueva la llamada a rxrpc_assess_MTU_size() fuera de rxrpc_init_peer() y a una posici\u00f3n m\u00e1s alta en la pila, donde pueda realizarse sin interrupciones deshabilitadas. No deber\u00eda ser un problema para rxrpc_new_incoming_call() realizarlo despu\u00e9s de que se eliminen los bloqueos, ya que pmtud lo realizar\u00e1 el hilo de E/S (y en este momento estamos en el hilo de E/S).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/rxrpc/ar-internal.h\",\"net/rxrpc/call_accept.c\",\"net/rxrpc/peer_object.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"77433b730970ca6e51d03016e830d8ab1b22685a\",\"lessThan\":\"d94b82d452ca27a200cd67660dc48476386651d8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"09c59a82298f424f6212c67fbea531853e88ce6c\",\"lessThan\":\"8ac0b3baa7d8f732bd9e5cbf1d8b57e4802c6b36\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a2ea9a9072607c2fd6442bd1ffb4dbdbf882aed7\",\"lessThan\":\"2029f21f10dedb88c0f86abffcf8d6c21dcf6040\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a2ea9a9072607c2fd6442bd1ffb4dbdbf882aed7\",\"lessThan\":\"e4d2878369d590bf8455e3678a644e503172eafa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.6.148\",\"lessThan\":\"6.6.151\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.101\",\"lessThan\":\"6.12.103\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/rxrpc/ar-internal.h\",\"net/rxrpc/call_accept.c\",\"net/rxrpc/peer_object.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.151\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.103\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.8\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.15.8\",\"matchCriteriaId\":\"3B1D6837-C0C8-4CC6-9D70-85B362FFE711\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"85421F4E-C863-4ABF-B4B4-E887CC2F7F92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3827F0D4-5FEE-4181-B267-5A45E7CA11FC\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2029f21f10dedb88c0f86abffcf8d6c21dcf6040\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ac0b3baa7d8f732bd9e5cbf1d8b57e4802c6b36\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d94b82d452ca27a200cd67660dc48476386651d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e4d2878369d590bf8455e3678a644e503172eafa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:08:29+00:00",
      "cve": "CVE-2025-38525",
      "id": "CVE-2025-38525",
      "initial_release_date": "2025-08-16T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: rxrpc: Fix irq-disabled in local_bh_enable()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38525.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-08-29T01:18:27Z",
      "cve": "CVE-2025-38525",
      "id": "CVE-2025-38525",
      "initial_release_date": "2025-08-16T23:22:46Z",
      "product_status:known_not_affected": "524",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38525",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38525.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.