CVE-2025-38675 xfrm: state: initialize state_ptrs earlier in xfrm_state_find
A race condition in the Linux kernel's xfrm state lookup can lead to uninitialized memory usage, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38675?
CVE-2025-38675 is a high-severity vulnerability in Linux kernel, published on 22 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xfrm: state: initialize state_ptrs earlier in xfrm_state_find
In case of preemption, xfrm_state_look_at will find a different pcpu_id and look up states for that other CPU. If we matched a state for CPU2 in the state_cache while the lookup started on CPU1, we will jump to "found", but the "best" state that we got will be ignored and we will enter the "acquire" block. This block uses state_ptrs, which isn't initialized at this point.
Let's initialize state_ptrs just after taking rcu_read_lock. This will also prevent a possible misuse in the future, if someone adjusts this function.
Weakness: CWE-362
Which versions are affected by CVE-2025-38675?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38675?
Apply the vendor's patch.
Is CVE-2025-38675 being exploited?
There is no known exploitation of CVE-2025-38675 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-87132, BELL-CVE-2025-38675, DEBIAN-CVE-2025-38675, GHSA-698j-xv88-2hj7, ROOT-OS-DEBIAN-13-CVE-2025-38675, ROOT-OS-UBUNTU-2404-CVE-2025-38675 and 1 more.