VulnerabilityPublished 16 Aug 2025Updated 30 Oct 2026

CVE-2025-38544: Linux kernel · rxrpc: Fix bug due to prealloc collision

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in d8ffb47a443919277cb093c3db1ec6c0a06880b1 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 12:33 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Patch: Available – fixed in d8ffb47a443919277cb093c3db1ec6c0a06880b1, 5385ad53793de2ab11e396bdcdaa65bb04b4dad6, 3838acfc347b803b66a2c8eb510da1c489d44ca1 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 16 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 00e907127e6f86d0f9b122d9b4347a8aa09a8b61, < d8ffb47a443919277cb093c3db1ec6c0a06880b1	Fixed in d8ffb47a443919277cb093c3db1ec6c0a06880b1
LinuxLinux	Affected ≥ 00e907127e6f86d0f9b122d9b4347a8aa09a8b61, < 5385ad53793de2ab11e396bdcdaa65bb04b4dad6	Fixed in 5385ad53793de2ab11e396bdcdaa65bb04b4dad6
LinuxLinux	Affected ≥ 00e907127e6f86d0f9b122d9b4347a8aa09a8b61, < 3838acfc347b803b66a2c8eb510da1c489d44ca1	Fixed in 3838acfc347b803b66a2c8eb510da1c489d44ca1
LinuxLinux	Affected ≥ 00e907127e6f86d0f9b122d9b4347a8aa09a8b61, < 432c5363cd6fe5a928bbc94524d28b05515684dd	Fixed in 432c5363cd6fe5a928bbc94524d28b05515684dd
LinuxLinux	Affected ≥ 00e907127e6f86d0f9b122d9b4347a8aa09a8b61, < 69e4186773c6445b258fb45b6e1df18df831ec45	Fixed in 69e4186773c6445b258fb45b6e1df18df831ec45
LinuxLinux	Affected =4.9	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix bug due to prealloc collision When userspace is using AF_RXRPC to provide a server, it has to preallocate incoming calls and assign to them call IDs that will be used to thread related recvmsg() and sendmsg() together. The preallocated call IDs will automatically be attached to calls as they come in until the pool is empty. To the kernel, the call IDs are just arbitrary numbers, but userspace can use the call ID to hold a pointer to prepared structs. In any case, the user isn't permitted to create two calls with the same call ID (call IDs become available again when the call ends) and EBADSLT should result from sendmsg() if an attempt is made to preallocate a call with an in-use call ID. However, the cleanup in the error handling will trigger both assertions in rxrpc_cleanup_call() because the call isn't marked complete and isn't marked as having been released. Fix this by setting the call state in rxrpc_service_prealloc_one() and then marking it as being released before calling the cleanup function.

References

Community reviews

Loading reviews…