CVE-2025-38727

What it actually does

The flaw in netlink_attachskb allows skb truesize plus sk_rmem_alloc to exactly equal sk_rcvbuf without triggering acceptance or rescheduling, causing netlink_unicast to loop indefinitely and produce RCU scheduler stalls.

Why it matters to the business

Linux systems handling netlink traffic such as audit logging can freeze or become unresponsive, interrupting services and requiring reboots or kernel updates; affected container and MinimOS deployments increase operational risk across many environments.

How an attack unfolds

An attacker with local access triggers netlink unicast paths (for example via audit events) that reach the exact memory boundary condition missed by the restructured checks; repeated triggering leads to CPU stalls. Threat actors including VMSCAPE have targeted similar Linux kernel issues on Container-Optimized OS.

How to fix it

Upgrade Linux kernel to 5.4.297 or apply commit 47d49fd07f86d1f55ea1083287303d237e9e0922; upgrade argocd-2.13, argocd-2.13-repo-server and argocd-2.13-compat on MinimOS to 2.13.8-r3.

How to confirm the fix worked

Verify running kernel version against fixed releases; reproduce netlink unicast under memory pressure and confirm absence of indefinite retry loops or RCU stall messages; review dmesg for the original stall signatures.

Typical attack path

1. Obtain local code execution or user privileges on an affected Linux kernel
2. Generate netlink traffic that exercises netlink_unicast with memory allocation at the exact rcvbuf boundary
3. Force repeated calls to netlink_attachskb without progress
4. Induce RCU stall and system degradation

How to detect it

Search kernel logs and dmesg for RCU self-detected stall messages referencing netlink_attachskb, kauditd_send_queue or netlink_unicast; correlate with audit subsystem activity.

• rcu: INFO: rcu_sched self-detected stall on CPU
• netlink_attachskb net/netlink/af_netlink.c
• kauditd_send_queue kernel/audit.c
• NMI backtrace for cpu

What your security team should do

• Apply kernel and argocd updates immediately on all affected hosts given the 418-day exposure window
• Monitor kernel logs for RCU stall indicators involving kauditd and netlink
• Restrict local access and audit netlink usage where possible until patched