VulnerabilityPublished 6 Jun 2025

CVE-2025-38002: Linux kernel · io_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo()

Affects Linux kernelSource CVE Database V5

Not known to be exploited.

Data as of 26 Oct 2026, 09:15 UTC

Severity

Medium

Rated Medium by the CNA (Linux) · No CVSS score from NVD or the CNA

EPSS: 0.2% chance of exploitation in 30 days – higher than 13% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

European organizations should prioritize updating their Linux kernels to versions where this vulnerability is patched. Specifically, they should track kernel releases post the commit fixing the io_uring locking issue and apply these updates promptly. For environments where immediate patching is challenging, administrators should consider disabling or limiting the use of io_uring where feasible, especially in multi-tenant or high-concurrency scenarios. Monitoring kernel logs for unusual io_uring related errors or crashes can help detect exploitation attempts or instability. Additionally, organizations should audit their software stacks and container images to identify and update any components relying on vulnerable kernel versions. Employing kernel live patching solutions where available can reduce downtime during patch deployment. Finally, security teams should incorporate this vulnerability into their risk assessments and incident response plans, ensuring readiness to respond to any emerging exploit attempts.

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo() Not everything requires locking in there, which is why the 'has_lock' variable exists. But enough does that it's a bit unwieldy to manage. Wrap the whole thing in a ->uring_lock trylock, and just return with no output if we fail to grab it. The existing trylock() will already have greatly diminished utility/output for the failure case. This fixes an issue with reading the SQE fields, if the ring is being actively resized at the same time.

Impact

For European organizations, the impact of CVE-2025-38002 depends largely on their reliance on Linux systems utilizing io_uring for asynchronous I/O operations. Since io_uring is increasingly adopted in high-performance servers, cloud infrastructure, and containerized environments, any race condition or improper locking could lead to data inconsistency, potential information leakage, or denial of service if the kernel crashes or behaves unpredictably. Although this vulnerability does not directly indicate privilege escalation or remote code execution, the risk of corrupted kernel data structures or kernel panics could disrupt critical services, affecting availability and integrity. Organizations running critical infrastructure, financial services, telecommunications, or cloud providers in Europe that deploy Linux kernels with vulnerable io_uring implementations may face operational disruptions. Additionally, the subtlety of the bug means it could be exploited in targeted attacks to cause instability or data exposure in multi-tenant environments. However, the absence of known exploits and the nature of the vulnerability suggest the immediate risk is moderate but should not be underestimated in environments with high concurrency and I/O demands.

Summary

CVE-2025-38002 is a vulnerability identified in the Linux kernel, specifically related to the io_uring subsystem, which is a modern asynchronous I/O interface designed to improve performance and scalability of I/O operations. The vulnerability arises in the handling of file descriptor information (fdinfo) within io_uring, where the locking mechanism around the function io_uring_show_fdinfo() is insufficient. The issue is that while not all operations require locking, some critical sections do, and the existing code attempted to manage this complexity using a 'has_lock' variable. However, this approach was error-prone and unwieldy. The vulnerability manifests when the submission queue entries (SQE) fields are read concurrently while the ring buffer is being resized, leading to potential race conditions or inconsistent data reads. The fix involves wrapping the entire operation in a trylock on the uring_lock, and if the lock cannot be acquired, the function returns without output, thus preventing inconsistent or corrupted data exposure. This vulnerability does not appear to have known exploits in the wild yet and lacks a CVSS score, indicating it is newly disclosed and patched. The affected versions are specific Linux kernel commits identified by their hashes, suggesting this is a recent codebase issue addressed in kernel updates.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 7 Jul 2025, 20:27 UTC

Technical details

References

Community reviews

Related threats