CVE-2025-38617: net/packet: fix a race in packet_set_ring() and packet_notifier()
In the Linux kernel, the following vulnerability has been resolved:
net/packet: fix a race in packetsetring() and packetnotifier()
When packetsetring() releases po->bindlock, another thread can run packetnotifier() and process an NETDEVUP event.
This race and the fix are both similar to that of commit 15fe076edea7 ("net/packet: fix a race in packetbind() and packetnotifier()").
There too the packetnotifier NETDEVUP event managed to run while a po->bindlock critical section had to be temporarily released. And the fix was similarly to temporarily set po->num to zero to keep the socket unhooked until the lock is retaken.
The po->bindlock in packetsetring and packetnotifier precede the introduction of git history.
Affected Software
Remediation
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-5291
- CVE-2026-4679
- CVE-2026-4449
- CVE-2026-4674
- CVE-2026-4442
- CVE-2026-4451
- CVE-2026-5292
- CVE-2026-5282
- CVE-2026-3922
- CVE-2026-5280
- CVE-2026-4458
- CVE-2026-3923
- CVE-2026-4462
- CVE-2026-4454
- CVE-2026-4675
- CVE-2025-37752
- CVE-2025-37756
- CVE-2025-37797
- CVE-2025-37890
- CVE-2025-37997
- CVE-2025-38000
- CVE-2025-38001
- CVE-2025-38083
- CVE-2025-38177
- CVE-2025-38350
- CVE-2025-38477
- CVE-2025-38616
- CVE-2025-38618
Frequently Asked Questions
What is the severity of CVE-2025-38617?
The severity of CVE-2025-38617 is considered medium due to the potential race condition in the Linux kernel.
How do I fix CVE-2025-38617?
To fix CVE-2025-38617, update to the latest version of the Linux kernel where the vulnerability has been patched.
What systems are affected by CVE-2025-38617?
CVE-2025-38617 affects Linux systems using the affected versions of the Linux kernel.
What are the potential impacts of CVE-2025-38617?
The potential impacts of CVE-2025-38617 include possible denial of service due to the race condition.
Is CVE-2025-38617 publicly disclosed?
Yes, CVE-2025-38617 has been publicly disclosed and is documented in security advisories.