AZL-66887
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-66887.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-66887
- Upstream
- Published
- 2025-09-04T16:15:41Z
- Modified
- 2026-09-14T05:26:59Z
- Summary
- CVE-2025-38717 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net: kcm: Fix race condition in kcm_unattach()
syzbot found a race condition when kcm_unattach(psock) and kcm_release(kcm) are executed at the same time.
kcm_unattach() is missing a check of the flag kcm->tx_stopped before calling queue_work().
If the kcm has a reserved psock, kcm_unattach() might get executed between cancel_work_sync() and unreserve_psock() in kcm_release(), requeuing kcm->tx_work right before kcm gets freed in kcm_done().
Remove kcm->tx_stopped and replace it by the less error-prone disable_work_sync().
- References