Cloudanix VulnDB

CVE-2025-38611

None

CVSS

—

EPSS

—

Published

Aug 19, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel could let certain programs read private operating-system data they are not supposed to see.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to zero the vmci_event_ctx payload before vmci_datagram_dispatch when init_context fails allows uninitialized kernel memory to be copied into a datagram that is delivered to user space.

Why it matters to the business

Kernel memory disclosure on systems using the Linux kernel vmci subsystem can expose sensitive internal data to local processes, increasing confidentiality risk on any host running the affected Debian linux package.

How an attack unfolds

An attacker runs concurrent unlocked_ioctl calls from separate tasks against the vmci device; when one task's init_context fails, the partially-initialized struct is dispatched and its uninitialized payload is read by the other task in user space.

How to fix it

Upgrade the linux package on Debian 14 to version 6.16.3-1 or later, which applies the fix that explicitly zeros the payload before dispatch.

How to confirm the fix worked

Confirm the running kernel reports version 6.16.3-1 or newer; inspect the vmci code path to verify payload is zeroed prior to vmci_datagram_dispatch.

Typical attack path

  1. Open the vmci device and issue concurrent unlocked_ioctl calls from two tasks
  2. Force init_context to fail in one task
  3. Trigger vmci_datagram_dispatch of the incomplete event struct
  4. Read the uninitialized payload from the datagram received in user space

How to detect it

Review kernel and audit logs for repeated or concurrent unlocked_ioctl activity on vmci devices; examine any user-space processes that interact with vmci datagram queues for anomalous behavior.

What your security team should do

  • Apply the linux 6.16.3-1 package update immediately on all Debian 14 systems
  • Restrict local access to the vmci device to only trusted processes
  • Include vmci-related kernel modules in routine vulnerability scanning and patch automation

The record

In the Linux kernel, the following vulnerability has been resolved: vmci: Prevent the dispatching of uninitialized payloads The reproducer executes the host's unlocked_ioctl call in two different tasks. When init_context fails, the struct vmci_event_ctx is not fully initialized when executing vmci_datagram_dispatch() to send events to all vm contexts. This affects the datagram taken from the datagram queue of its context by another task, because the datagram payload is not initialized according to the size payload_size, which causes the kernel data to leak to the user space. Before dispatching the datagram, and before setting the payload content, explicitly set the payload content to 0 to avoid data leakage caused by incomplete payload initialization.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:12 linux 0 No fix
Debian:13 linux 0 No fix
Debian:14 linux 0 No fix
Debian:14 linux 0 6.16.3-1
Mageia:9 kernel 0 6.6.105-1.mga9
Mageia:9 kernel-linus 0 6.6.105-1.mga9
Mageia:9 kmod-virtualbox 0 7.1.10-10.mga9
Mageia:9 kmod-xtables-addons 0 3.24-86.mga9
Mageia:9 mageia-repos 0 9-4.mga9
Mageia:9 meta-task 0 9-4.mga9

Related vulnerabilities