CVE-2025-38102

What it actually does

Race condition between vmci_host_setup_notify and vmci_ctx_unset_notify allows notify_page to be freed via put_page while get_user_pages_fast is still executing, triggering try_grab_folio warnings and potential invalid page references in the Linux kernel VMCI subsystem.

Why it matters to the business

Kernel instability or crashes on affected Linux systems using VMCI, particularly in virtualized environments; low exploitation likelihood with no KEV listing or ransomware use, though downstream packages like nri-rabbitmq require updates.

How an attack unfolds

An attacker with local access triggers concurrent vmci_host_do_set_notify and vmci_host_do_set_notify paths to hit the window where context->notify_page is observed and put_page is called before get_user_pages_fast completes, as described in the CPU0/CPU1 timeline; listed threat actors focus on similar Linux kernel privilege escalations.

How to fix it

Upgrade to fixed versions: nri-rabbitmq and nri-rabbitmq-compat (Chainguard/Wolfi) to 2.15.0-r2; Linux kernel to commit 74095bbbb19ca74a0368d857603a2438c88ca86c or later stable releases.

How to confirm the fix worked

Verify kernel or package versions match fixed releases, reproduce the original syz.3.31 test case to confirm absence of the try_grab_folio warning, and review git history for the referenced commit.

Typical attack path

1. Obtain local code execution on a system with VMCI loaded
2. Invoke vmci_host_unlocked_ioctl to call vmci_host_do_set_notify
3. Concurrently trigger vmci_ctx_unset_notify from another context
4. Force the race during gup_huge_pmd and follow_trans_huge_pmd to hit put_page before __gup_longterm_locked finishes
5. Observe try_grab_folio warning or kernel instability

How to detect it

Search kernel logs for the exact warning string 'WARNING: CPU: .* at mm/gup.c:147 try_grab_folio' along with call traces containing vmci_host_unlocked_ioctl and follow_huge_pmd; review audit logs for unusual VMCI ioctl sequences.

• WARNING: CPU: .* at mm/gup.c:147 try_grab_folio+0x106/0x130
• vmci_host_unlocked_ioctl+0x21c/0xf80
• follow_huge_pmd+0x240/0x8e0

What your security team should do

• Apply kernel and package updates immediately given the 481 days since publication and rising EPSS trend
• Monitor system logs for GUP warnings on VMCI-enabled hosts
• Restrict unprivileged access to VMCI ioctls until patched
• Test virtualization workloads post-upgrade for stability