5.5

CVE-2025-38588: debian debian_linux Infinite Loop

CVSS: 5.5v3.1MediumAnalyzed
AliasesSUSE-SU-2026:20271-1SUSE-SU-2026:20272-1SUSE-SU-2026:20273-1
Published 19-08-2025Last modified 23-05-2026
Open JSON

Vulnerability summary

CVE-2025-38588 is a medium (CVSS 5.5) Infinite Loop vulnerability in debian debian_linux. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.6% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.17%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 79 · Related 76
DLA-4328-1MGASA-2025-0234MGASA-2025-0235OPENSUSE-SU-2025:20081-1SUSE-SU-2025:03272-1SUSE-SU-2025:03290-1

Timeline

  1. 19-08-2025
    PublishedVulnerability first disclosed.
  2. 23-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent infinite loop in rt6_nlmsg_size() While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, fib6_siblings) { rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); } This is because fib6_del_route() and fib6_add_rt2node() uses list_del_rcu(), which can confuse rcu readers, because they might no longer see the head of the list. Restart the loop if f6i->fib6_nsiblings is zero.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.17%

Chance of exploitation in the next 30 days

Percentile

6%

Versus all other CVEs

30-day change

+0.01 pp

From 0.16% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.17%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu121 products
  • linux< 6.8.0-100.100
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 6.8.0-1046.49
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Suse12 products
  • kernel-livepatch-MICRO-6-0_Update_4&distro=SUSE Linux Micro 6.0< 16-1.2
  • kernel-livepatch-MICRO-6-0_Update_4&distro=SUSE Linux Micro 6.1< 16-1.2
  • kernel-livepatch-MICRO-6-0_Update_5&distro=SUSE Linux Micro 6.0< 14-1.2
  • kernel-livepatch-MICRO-6-0_Update_5&distro=SUSE Linux Micro 6.1< 14-1.2
  • kernel-livepatch-MICRO-6-0_Update_6&distro=SUSE Linux Micro 6.0< 12-3.1
Debian2 products
  • linux< 6.1.148-1 | < 6.12.43-1 | < 6.16.3-1
  • debian_linuxEOL11.0
Linux2 products
  • linux≥ d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2, < 6d345136c9b875f065d226908a29c25cdf9343f8 | ≥ 52da02521ede55fb86546c3fffd9377b3261b91f, < e1b7932af47f92432be8303d2439d1bf77b0be23 | ≥ 34a949e7a0869dfa31a40416d2a56973fae1807b, < cd8d8bbd9ced4cc5d06d858f67d4aa87745e8f38 | ≥ d9ccb18f83ea2bb654289b6ecf014fd267cc988b, < 3c13db3e47e170bab19e574404e7b6be45ea873d | ≥ d9ccb18f83ea2bb654289b6ecf014fd267cc988b, < 46aeb66e9e54ed0d56c18615e1c3dbd502b327ab | ≥ d9ccb18f83ea2bb654289b6ecf014fd267cc988b, < 54e6fe9dd3b0e7c481c2228782c9494d653546da | 11edcd026012ac18acee0f1514db3ed1b160fc6f | ≥ 6.1.128, < 6.1.148 | ≥ 6.6.75, < 6.6.102 | ≥ 6.12.2, < 6.12.42 | ≥ 6.11.11, < 6.12 | 6.13
  • linux_kernel≥ 6.1.128, < 6.1.148 | ≥ 6.6.75, < 6.6.102 | ≥ 6.11.11, < 6.12 | ≥ 6.12.2, < 6.12.42 | ≥ 6.13, < 6.15.10 | ≥ 6.16, < 6.16.1

4 vendors · 137 products

References

48 links
Show all 48 references