In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix oops due to non-existence of prealloc backlog struct
If an AFRXRPC service socket is opened and bound, but calls are preallocated, then rxrpcallocincomingcall() will oops because the rxrpc_backlog struct doesn't get allocated until the first preallocation is made.
Fix this by returning NULL from rxrpcallocincoming_call() if there is no backlog struct. This will cause the incoming call to be aborted.
[
{
"id": "CVE-2025-38514-0336c2d4",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rxrpc/call_accept.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7afb3ff01c42c49e8a143cdce400b95844bb506",
"digest": {
"line_hashes": [
"295049098256509518296957906318580387410",
"74643106715526304910735915445097596448",
"188639669997653022634866737942311501108"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2025-38514-0cfda844",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "rxrpc_alloc_incoming_call",
"file": "net/rxrpc/call_accept.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7afb3ff01c42c49e8a143cdce400b95844bb506",
"digest": {
"length": 1849.0,
"function_hash": "134616599304558709455421948789768907471"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38514-6d3442c1",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "rxrpc_alloc_incoming_call",
"file": "net/rxrpc/call_accept.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@880a88f318cf1d2a0f4c0a7ff7b07e2062b434a4",
"digest": {
"length": 2123.0,
"function_hash": "212527817771460121810552651529846416611"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38514-9f83ae8f",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/rxrpc/call_accept.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@880a88f318cf1d2a0f4c0a7ff7b07e2062b434a4",
"digest": {
"line_hashes": [
"295049098256509518296957906318580387410",
"74643106715526304910735915445097596448",
"188639669997653022634866737942311501108"
],
"threshold": 0.9
},
"signature_type": "Line"
}
]