7.5

CVE-2025-38514: rxrpc: Fix oops due to non-existence of prealloc backlog struct

Modified
AliasesUBUNTU-CVE-2025-38514DEBIAN-CVE-2025-38514
Published 16-08-2025Last modified 15-10-2026

Vulnerability summary

CVE-2025-38514 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.5% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.37%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 49 · Related 47
DLA-4327-1DLA-4328-1OPENSUSE-SU-2025:20081-1SUSE-SU-2025:03600-1SUSE-SU-2025:03601-1SUSE-SU-2025:03602-1

Timeline

  1. 16-08-2025
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix oops due to non-existence of prealloc backlog struct If an AF_RXRPC service socket is opened and bound, but calls are preallocated, then rxrpc_alloc_incoming_call() will oops because the rxrpc_backlog struct doesn't get allocated until the first preallocation is made. Fix this by returning NULL from rxrpc_alloc_incoming_call() if there is no backlog struct. This will cause the incoming call to be aborted.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.37%

Chance of exploitation in the next 30 days

Percentile

30%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.36% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu148 products
  • linuxAll versions (No fix recorded) | < 5.15.0-156.166 | < 6.8.0-100.100
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1092.99 | < 6.8.0-1046.49
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.147-1 | < 6.12.41-1 | < 6.16.3-1
  • debian_linuxEOL11.0
Linux2 products
  • linux≥ 248f219cb8bcbfbd7f132752d44afa2df7c241d1, < bf0ca6a1bc4fb904b598137c6718785a107e3adf | ≥ 248f219cb8bcbfbd7f132752d44afa2df7c241d1, < f7afb3ff01c42c49e8a143cdce400b95844bb506 | ≥ 248f219cb8bcbfbd7f132752d44afa2df7c241d1, < f5e72b7824d08c206ce106d30cb37c4642900ccc | ≥ 248f219cb8bcbfbd7f132752d44afa2df7c241d1, < 0eef29385d715d4c7fd707b18d4a9b76c76dd5e6 | ≥ 248f219cb8bcbfbd7f132752d44afa2df7c241d1, < efc1b2b7c1a308b60df8f36bc2d7ce16d3999364 | ≥ 248f219cb8bcbfbd7f132752d44afa2df7c241d1, < d1ff5f9d2c5405681457262e23c720b08977c11f | ≥ 248f219cb8bcbfbd7f132752d44afa2df7c241d1, < 2c2e9ebeb036f9b1b09325ec5cfdfe0e78f357c3 | ≥ 248f219cb8bcbfbd7f132752d44afa2df7c241d1, < 880a88f318cf1d2a0f4c0a7ff7b07e2062b434a4 | 4.9
  • linux_kernel≥ 4.9, < 5.4.296 | ≥ 5.5, < 5.10.240 | ≥ 5.11, < 5.15.189 | ≥ 5.16, < 6.1.146 | ≥ 6.2, < 6.6.99 | ≥ 6.7, < 6.12.39 | ≥ 6.13, < 6.15.7 | 6.16:rc1 | 6.16:rc2 | 6.16:rc3 | 6.16:rc4 | 6.16:rc5

3 vendors · 152 products

References

46 links
Show all 46 references