Answer in brief
CVE-2025-38524 records a High severity (CVSS 7.5) vulnerability in rxrpc: Fix recv-recv race of completed call. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | 4.9 | Not reported |
| Linux/Linuxgeneric | >=248f219cb8bcbfbd7f132752d44afa2df7c241d1 <4aed0eeca58e26d752bb08b293b8dc75c6820b23 || >=248f219cb8bcbfbd7f132752d44afa2df7c241d1 <7692bde890061797f3dece0148d7859e85c55778 || >=248f219cb8bcbfbd7f132752d44afa2df7c241d1 <839fe96c15209dc2255c064bb44b636efe04f032 || >=248f219cb8bcbfbd7f132752d44afa2df7c241d1 <6c75a97a32a5fa2060c3dd30207e63b6914b606d || >=248f219cb8bcbfbd7f132752d44afa2df7c241d1 <962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc | 4aed0eeca58e26d752bb08b293b8dc75c6820b23, 7692bde890061797f3dece0148d7859e85c55778, 839fe96c15209dc2255c064bb44b636efe04f032, 6c75a97a32a5fa2060c3dd30207e63b6914b606d, 962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc |
| Linux/Linuxgeneric | >=248f219cb8bcbfbd7f132752d44afa2df7c241d1 <7692bde890061797f3dece0148d7859e85c55778 || >=248f219cb8bcbfbd7f132752d44afa2df7c241d1 <839fe96c15209dc2255c064bb44b636efe04f032 || >=248f219cb8bcbfbd7f132752d44afa2df7c241d1 <6c75a97a32a5fa2060c3dd30207e63b6914b606d || >=248f219cb8bcbfbd7f132752d44afa2df7c241d1 <962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc | 7692bde890061797f3dece0148d7859e85c55778, 839fe96c15209dc2255c064bb44b636efe04f032, 6c75a97a32a5fa2060c3dd30207e63b6914b606d, 962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc |
| Linux/Linuxgeneric | >=248f219cb8bcbfbd7f132752d44afa2df7c241d1 <4aed0eeca58e26d752bb08b293b8dc75c6820b23 || >=248f219cb8bcbfbd7f132752d44afa2df7c241d1 <cb720b068b18fb39c96980eb3c13f09427512be7 || >=248f219cb8bcbfbd7f132752d44afa2df7c241d1 <7692bde890061797f3dece0148d7859e85c55778 || >=248f219cb8bcbfbd7f132752d44afa2df7c241d1 <839fe96c15209dc2255c064bb44b636efe04f032 || >=248f219cb8bcbfbd7f132752d44afa2df7c241d1 <6c75a97a32a5fa2060c3dd30207e63b6914b606d || >=248f219cb8bcbfbd7f132752d44afa2df7c241d1 <962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc | 4aed0eeca58e26d752bb08b293b8dc75c6820b23, cb720b068b18fb39c96980eb3c13f09427512be7, 7692bde890061797f3dece0148d7859e85c55778, 839fe96c15209dc2255c064bb44b636efe04f032, 6c75a97a32a5fa2060c3dd30207e63b6914b606d, 962fb1f651c2cf2083e0c3ef53ba69e3b96d3fbc |
Published upstream
Aug 16, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recv-recv race of completed call If a call receives an event (such as incoming data), the call gets placed on the socket's queue and a thread in recvmsg can be awakened to go and process it. Once the thread has picked up the call off of the queue, further events will cause it to be requeued, and once the socket lock is dropped (recvmsg uses call->user_mutex to allow the socket to be used in parallel), a second thread can come in and its recvmsg can pop the call off the socket queue again. In such a case, the first thread will be receiving stuff from the call and the second thread will be blocked on call->user_mutex. The first thread can, at this point, process both the event that it picked call for and the event that the second thread picked the call for and may see the call terminate - in which case the call will be "released", decoupling the call from the user call ID assigned to it (RXRPC_USER_CALL_ID in the control message). The first thread will return okay, but then the second thread will wake up holding the user_mutex and, if it sees that the call has been released by the first thread, it will BUG thusly: kernel BUG at net/rxrpc/recvmsg.c:474! Fix this by just dequeuing the call and ignoring it if it is seen to be already released. We can't tell userspace about it anyway as the user call ID has become stale.
Quoted source text, attributed separately from HOL analysis.