High 7.8Published Sep 4, 2025

CVE-2025-38717net: kcm: Fix race condition in kcm_unattach()

Updated under an hour ago (Oct 27, 2026, 10:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Fix race condition in kcm_unattach() syzbot found a race condition when kcm_unattach(psock) and kcm_release(kcm) are executed at the same time. kcm_unattach() is missing a check of the flag kcm->tx_stopped before calling queue_work(). If the kcm has a reserved psock, kcm_unattach() might get executed between cancel_work_sync() and unreserve_psock() in kcm_release(), requeuing kcm->tx_work right before kcm gets freed in kcm_done(). Remove kcm->tx_stopped and replace it by the less error-prone disable_work_sync().

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 before c0bffbc92a1ca3960fb9cdb8e9f75a68468eb308; from ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 before 7275dc3bb8f91b23125ff3f47b6529935cf46152; from ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 before 798733ee5d5788b12e8a52db1519abc17e826f69; from ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 before 52565a935213cd6a8662ddb8efe5b4219343a25d	CNA record
linux linux_kernel linux:linux_kernel	from 4.6 before 6.12.43; from 6.13 before 6.15.11; from 6.16 before 6.16.2; 6.17	NVD

References

References

https://git.kernel.org/stable/c/c0bffbc92a1ca3960fb9cdb8e9f75a68468eb308	patch
https://git.kernel.org/stable/c/7275dc3bb8f91b23125ff3f47b6529935cf46152	patch
https://git.kernel.org/stable/c/798733ee5d5788b12e8a52db1519abc17e826f69	patch
https://git.kernel.org/stable/c/52565a935213cd6a8662ddb8efe5b4219343a25d	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.