CVE-2025-38587

What it actually does

The vulnerability creates a possible infinite loop in fib6_info_uses_dev() because the function relies on RCU list traversal without explicit protection; concurrent execution of fib6_del_route() or fib6_add_rt2node() can remove the list anchor, causing the iteration to never terminate.

Why it matters to the business

Systems may experience kernel-level hangs or sustained high CPU usage in IPv6 routing paths, leading to degraded network performance or full denial of service; the issue affects Linux kernel deployments and downstream packages with moderate ecosystem reach, though exploitation remains unlikely based on current scores and no known ransomware use.

How an attack unfolds

An attacker with the ability to trigger concurrent IPv6 route additions and deletions (for example via container networking changes on Container-Optimized OS) races against fib6_info_uses_dev() to remove the list anchor while the function is iterating, resulting in an unrecoverable loop; similar privilege-escalation techniques observed in related kernel CVEs on the same platform could be adapted to reach this code path.

How to fix it

Upgrade the Linux kernel to version 6.1.148 or apply commit bc85e62394f008fa848c4ba02c936c735a3e8ef5; Chainguard packages should be updated to openjdk-8-openj9 0.53.0-r1 or later; verify the exact fixed version for each distribution and rebuild any custom kernels containing the vulnerable ipv6 routing code.

How to confirm the fix worked

Confirm the running kernel version is at or above the listed fixed releases, review dmesg or kernel logs for the presence of the upstream commit message, and test IPv6 route churn workloads to ensure fib6_info_uses_dev() no longer loops.

Typical attack path

1. Obtain local or container-level access capable of modifying IPv6 routes
2. Trigger repeated fib6_add_rt2node() and fib6_del_route() operations while fib6_info_uses_dev() is executing under RCU
3. Remove the list anchor during traversal to force an infinite loop
4. Sustain the condition to consume CPU or hang the networking stack

How to detect it

Search kernel and system logs for sustained high CPU in IPv6-related functions or unexpected hangs during route table modifications; correlate with container runtime events that alter IPv6 routes on affected hosts.

What your security team should do

• Apply the kernel update to 6.1.148 or the referenced commit within the next maintenance window given the 434-day publication age
• Monitor CPU usage of kernel networking threads on systems performing frequent IPv6 route changes
• Restrict untrusted container workloads from manipulating IPv6 routing tables until patches are deployed
• Include the fixed commit in all downstream kernel builds and CI regression tests for route table operations