CVE-2025-38006

What it actually does

The flaw causes the kernel to read uninitialized memory from ifa_index in mctp_dump_addrinfo when a struct ifaddrmsg is absent during netlink address dumping for MCTP interfaces, leading to KMSAN-detected uninit-value usage and potential denial of service.

Why it matters to the business

Local users or processes on affected Linux systems can trigger kernel instability or crashes, disrupting network operations and requiring reboots; high prevalence in container and server environments increases operational risk for organizations relying on recent kernels.

How an attack unfolds

An attacker with local access crafts a netlink RTM_GETADDR request or invokes userspace tools such as ip addr show or dhcpd that invoke rtnl_dump_all without supplying a valid ifaddrmsg, causing the MCTP handler to compare against uninitialized stack memory and trigger the bug.

How to fix it

Update the Linux kernel to the fixed commit acab78ae12c7fefb4f3bfe22e00770a5faa42724 or later stable release containing the patch; rebuild and deploy updated kernel packages across all affected systems.

How to confirm the fix worked

Confirm kernel source contains the referenced commit or run a kernel version check post-upgrade; attempt reproduction with syzkaller-style netlink dumps or ip commands to verify absence of KMSAN reports.

Typical attack path

1. Obtain local shell or process execution on target system
2. Invoke netlink socket call or userspace utility that requests MCTP address dump without ifaddrmsg
3. Trigger mctp_dump_addrinfo path in kernel netlink handling
4. Cause uninitialized memory access leading to KMSAN fault or system instability

How to detect it

Review kernel logs for KMSAN uninit-value reports referencing mctp_dump_addrinfo or net/mctp/device.c; inspect netlink audit logs for unexpected RTM_GETADDR requests from non-standard processes.

What your security team should do

• Prioritize kernel upgrades on all production and container hosts within the next maintenance window
• Monitor EPSS trend and re-evaluate if new exploit code appears
• Restrict unprivileged local access where feasible until patches are applied