CVE-2025-38588

What it actually does

Race condition in IPv6 routing allows RCU readers to observe inconsistent fib6_siblings list state after list_del_rcu, causing rt6_nlmsg_size to enter an infinite loop when fib6_nsiblings is zero.

Why it matters to the business

Systems running affected Linux kernels may experience kernel-level hangs or excessive CPU usage in the networking stack when IPv6 routes are modified under load, leading to network outages and degraded container or host performance; high downstream prevalence increases patch urgency across distributions and container images.

How an attack unfolds

An attacker with local or container access triggers concurrent IPv6 route additions and deletions while a netlink dump reader iterates the fib6_siblings list; the resulting list inconsistency causes the size calculation loop to restart indefinitely, consuming CPU and potentially leading to denial of service. Related container-optimized OS privilege-escalation campaigns have targeted similar kernel race conditions.

How to fix it

Upgrade Linux kernel to 6.1.148 or later (commit 6d345136c9b875f065d226908a29c25cdf9343f8); for Chainguard images update openjdk-11-openj9 packages to 0.53.0-r0. Reboot or reload affected modules after upgrade.

How to confirm the fix worked

Confirm kernel version is at or above the fixed release; run IPv6 route modification stress tests while monitoring for rt6_nlmsg_size loops via perf or ftrace; verify absence of the vulnerable list iteration pattern in rt6_nlmsg_size.

Typical attack path

1. Obtain local or container execution context on an affected kernel
2. Perform concurrent IPv6 route operations (add/delete) while triggering netlink route dumps
3. Exploit RCU visibility window created by list_del_rcu without proper synchronization
4. Induce infinite loop in rt6_nlmsg_size consuming CPU resources

How to detect it

Search kernel logs and netlink audit trails for repeated or stalled calls to rt6_nlmsg_size or fib6_siblings iteration during route changes; correlate with high CPU in ksoftirqd or netlink handling threads; review container runtime logs for IPv6 route churn preceding hangs.

• rt6_nlmsg_size
• fib6_siblings
• fib6_nsiblings == 0
• list_for_each_entry_rcu.*fib6_siblings

What your security team should do

• Prioritize kernel upgrades on all IPv6-enabled hosts and container nodes within CISA-relevant timelines if applicable
• Monitor for high CPU in netlink or IPv6 route handling processes
• Apply compensating controls such as disabling unnecessary IPv6 netlink listeners until patched
• Include this race condition family in future kernel fuzzing and RCU audit campaigns