In the Linux kernel, the following vulnerability has been resolved:
vsock: Fix transport_* TOCTOU
Transport assignment may race with module unload. Protect new_transport from becoming a stale pointer.
This also takes care of an insecure call in vsockuselocal_transport(); add a lockdep assert.
BUG: unable to handle page fault for address: fffffbfff8056000 Oops: Oops: 0000 [#1] SMP KASAN RIP: 0010:vsockassigntransport+0x366/0x600 Call Trace: vsockconnect+0x59c/0xc40 _sysconnect+0xe8/0x100 _x64sysconnect+0x6e/0xc0 dosyscall64+0x92/0x1c0 entrySYSCALL64afterhwframe+0x4b/0x53
[
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "vsock_assign_transport",
"file": "net/vmw_vsock/af_vsock.c"
},
"digest": {
"function_hash": "14409643835709380337536167973513775798",
"length": 1345.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@687aa0c5581b8d4aa87fd92973e4ee576b550cdf",
"signature_type": "Function",
"id": "CVE-2025-38461-17f17abe"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "vsock_use_local_transport",
"file": "net/vmw_vsock/af_vsock.c"
},
"digest": {
"function_hash": "300933839779218732870363570293988410037",
"length": 258.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae2c712ba39c7007de63cb0c75b51ce1caaf1da5",
"signature_type": "Function",
"id": "CVE-2025-38461-3727396a"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"digest": {
"line_hashes": [
"74306742378994936627535891610403102012",
"297345289586158175898936831543434502933",
"23388145366096737612294266189646426421",
"70487200214417217168058929241398815715",
"278325648168829287053509457569368419438",
"124102257222253645780731914447376980895",
"47984068747157313330757745597221027488",
"71238333618965466741039282302678942923",
"233450524760474551923965114457395745857",
"196580439175733333512196638240773626300",
"312605958877003212005520038988533966964",
"206604360605926889320911154726412240822",
"271536560392994716758101108230334879177",
"209661329811138975731688117458261286039",
"330034853576070158429227526574450497647",
"256628874105124338046959292490004238245",
"22777883027245868696891724960631809578",
"198458082955850565284080093009219966808",
"37269968405064257175426600845533384516",
"247690070237783567487824508958622508178",
"145765221195692170497772680847456770792",
"271536832807183210192875483483693924508",
"42123183091051729736873538358137607005",
"77800108191026163873107172320295947229"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@687aa0c5581b8d4aa87fd92973e4ee576b550cdf",
"signature_type": "Line",
"id": "CVE-2025-38461-729620db"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "vsock_use_local_transport",
"file": "net/vmw_vsock/af_vsock.c"
},
"digest": {
"function_hash": "300933839779218732870363570293988410037",
"length": 258.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@687aa0c5581b8d4aa87fd92973e4ee576b550cdf",
"signature_type": "Function",
"id": "CVE-2025-38461-d1ae6eb5"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"digest": {
"line_hashes": [
"74306742378994936627535891610403102012",
"297345289586158175898936831543434502933",
"23388145366096737612294266189646426421",
"70487200214417217168058929241398815715",
"278325648168829287053509457569368419438",
"124102257222253645780731914447376980895",
"47984068747157313330757745597221027488",
"71238333618965466741039282302678942923",
"233450524760474551923965114457395745857",
"196580439175733333512196638240773626300",
"312605958877003212005520038988533966964",
"206604360605926889320911154726412240822",
"271536560392994716758101108230334879177",
"209661329811138975731688117458261286039",
"330034853576070158429227526574450497647",
"256628874105124338046959292490004238245",
"22777883027245868696891724960631809578",
"198458082955850565284080093009219966808",
"37269968405064257175426600845533384516",
"247690070237783567487824508958622508178",
"145765221195692170497772680847456770792",
"271536832807183210192875483483693924508",
"42123183091051729736873538358137607005",
"77800108191026163873107172320295947229"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae2c712ba39c7007de63cb0c75b51ce1caaf1da5",
"signature_type": "Line",
"id": "CVE-2025-38461-d658e597"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "vsock_assign_transport",
"file": "net/vmw_vsock/af_vsock.c"
},
"digest": {
"function_hash": "14409643835709380337536167973513775798",
"length": 1345.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae2c712ba39c7007de63cb0c75b51ce1caaf1da5",
"signature_type": "Function",
"id": "CVE-2025-38461-f690c815"
}
]