CVE-2025-38048

None

CVSS

—

EPSS

0.1%

Published

Jun 18, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A small timing issue in how the Linux kernel handles network notifications inside virtual machines was corrected so the system behaves more reliably under heavy load.

Exploitation: Local Privilege
Attacker needs: Local User
Complexity: Theoretical
Impact: Other
Component: OS kernel
Class: Race Condition
Remediation: Patch
Effort: Low
Patch risk: None

What it actually does

Data race on the event_triggered flag in virtio_ring.c allowing concurrent write in virtqueue_enable_cb_delayed and read in virtqueue_disable_cb_split without synchronization, causing the optimization hint to be read as stale.

Why it matters to the business

Minor impact limited to temporary suboptimal interrupt behavior in virtio-based virtual networking; no data loss or privilege escalation risk and low operational disruption for most deployments.

How an attack unfolds

An attacker would need to trigger concurrent enable and disable callback paths on the same virtqueue from network transmit and interrupt contexts, but the race only affects an unreliable hint and cannot be leveraged for meaningful control or information disclosure.

How to fix it

Update the Linux kernel to commit 02d2d6caee3abc9335cfca35f8eb4492173ae6f2 or later; rebuild and reboot affected systems; apply vendor backports for stable branches.

How to confirm the fix worked

Rebuild with KCSAN enabled and confirm absence of the reported data-race warning on virtqueue_enable_cb_delayed and virtqueue_disable_cb; verify the event_triggered access is annotated with data_racy.

Typical attack path

Trigger network transmit on a virtio-net interface
Simultaneously cause vring interrupt handling
Observe or influence the event_triggered flag state via timing

How to detect it

Review kernel logs for KCSAN data-race reports mentioning virtqueue_enable_cb_delayed or virtqueue_disable_cb; examine virtio-net transmit paths for unexpected interrupt behavior.

What your security team should do

Prioritize kernel updates on systems using virtio networking in virtualized environments
Monitor for KCSAN reports in development and testing kernels
Apply the fix during the next scheduled maintenance window given low severity

The record

In the Linux kernel, the following vulnerability has been resolved: virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN syzbot reports a data-race when accessing the event_triggered, here is the simplified stack when the issue occurred: ================================================================== BUG: KCSAN: data-race in virtqueue_disable_cb / virtqueue_enable_cb_delayed write to 0xffff8881025bc452 of 1 bytes by task 3288 on cpu 0: virtqueue_enable_cb_delayed+0x42/0x3c0 drivers/virtio/virtio_ring.c:2653 start_xmit+0x230/0x1310 drivers/net/virtio_net.c:3264 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline] read to 0xffff8881025bc452 of 1 bytes by interrupt on cpu 1: virtqueue_disable_cb_split drivers/virtio/virtio_ring.c:880 [inline] virtqueue_disable_cb+0x92/0x180 drivers/virtio/virtio_ring.c:2566 skb_xmit_done+0x5f/0x140 drivers/net/virtio_net.c:777 vring_interrupt+0x161/0x190 drivers/virtio/virtio_ring.c:2715 __handle_irq_event_percpu+0x95/0x490 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] value changed: 0x01 -> 0x00 ================================================================== When the data race occurs, the function virtqueue_enable_cb_delayed() sets event_triggered to false, and virtqueue_disable_cb_split/packed() reads it as false due to the race condition. Since event_triggered is an unreliable hint used for optimization, this should only cause the driver temporarily suggest that the device not send an interrupt notification when the event index is used. Fix this KCSAN reported data-race issue by explicitly tagging the access as data_racy.

Affected packages

Ecosystem	Package	Introduced	Fixed
Debian:11	linux	0	No fix
Debian:12	linux	0	No fix
Debian:13	linux	0	6.12.32-1
Debian:14	linux	0	6.12.32-1
Linux	Kernel	0	5.15.185
Linux	Kernel	5.14.0	5.15.185