FlawAtlas
Search the atlas
CVE-2025-38617 Not scored

net/packet: fix a race in packet_set_ring() and packet_notifier()

In the Linux kernel, the following vulnerability has been resolved: net/packet: fix a race in packet_set_ring() and packet_notifier() When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This race and the fix are both similar to that of commit 15fe076edea7 ("net/packet: fix a race in packet_bind() and packet_notifier()"). There too the packet_notifier NETDEV_UP event managed to run while a po->bind_lock critical section had to be temporarily released. And the fix was similarly to temporarily set po->num to zero to keep the socket unhooked until the lock is retaken. The po->bind_lock in packet_set_ring and packet_notifier precede the introduction of git history.

Exploit probability 0.3%
Published August 22, 2025
Required by Not available
Last source change July 15, 2026

02 / AFFECTED SOFTWARE

Affected packages

Linux Kernel
Unknown Unknown

1898 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

related OPENSUSE-SU-2025:20081-1
related SUSE-SU-2025:03204-1
related SUSE-SU-2025:03272-1
related SUSE-SU-2025:03283-1
related SUSE-SU-2025:03290-1
related SUSE-SU-2025:03301-1
related SUSE-SU-2025:03310-1
related SUSE-SU-2025:03314-1
related SUSE-SU-2025:03344-1
related SUSE-SU-2025:03382-1
related SUSE-SU-2025:03383-1
related SUSE-SU-2025:03384-1
related SUSE-SU-2025:03602-1
related SUSE-SU-2025:03633-1
related SUSE-SU-2025:03634-1
related SUSE-SU-2025:20653-1
related SUSE-SU-2025:20669-1
related SUSE-SU-2025:20739-1
related SUSE-SU-2025:20756-1
related SUSE-SU-2025:20939-1
related SUSE-SU-2025:20940-1
related SUSE-SU-2025:20942-1
related SUSE-SU-2025:20943-1
related SUSE-SU-2025:20944-1
related SUSE-SU-2025:20945-1
related SUSE-SU-2025:20946-1
related SUSE-SU-2025:20947-1
related SUSE-SU-2025:20950-1
related SUSE-SU-2025:20951-1
related SUSE-SU-2025:20952-1
related SUSE-SU-2025:20953-1
related SUSE-SU-2025:20955-1
related SUSE-SU-2025:20956-1
related SUSE-SU-2025:20957-1
related SUSE-SU-2025:20959-1
related SUSE-SU-2025:20960-1
related SUSE-SU-2025:20973-1
related SUSE-SU-2025:20974-1
related SUSE-SU-2025:20975-1
related SUSE-SU-2025:20977-1
related SUSE-SU-2025:20978-1
related SUSE-SU-2025:20980-1
related SUSE-SU-2025:20981-1
related SUSE-SU-2025:20982-1
related SUSE-SU-2025:20983-1
related SUSE-SU-2025:20984-1
related SUSE-SU-2025:20985-1
related SUSE-SU-2025:20987-1
related SUSE-SU-2025:20988-1
related SUSE-SU-2025:20989-1
related SUSE-SU-2025:20991-1
related SUSE-SU-2025:21074-1
related SUSE-SU-2025:21139-1
related SUSE-SU-2025:21179-1
related SUSE-SU-2025:3878-1
related SUSE-SU-2025:3880-1
related SUSE-SU-2025:3886-1
related SUSE-SU-2025:3892-1
related SUSE-SU-2025:3927-1
related SUSE-SU-2025:3932-1
related SUSE-SU-2025:3935-1
related SUSE-SU-2025:3936-1
related SUSE-SU-2025:3983-1
related SUSE-SU-2025:3995-1
related SUSE-SU-2025:4000-1
related SUSE-SU-2025:4001-1
related SUSE-SU-2025:4016-1
related SUSE-SU-2025:4024-1
related SUSE-SU-2025:4031-1
related SUSE-SU-2025:4036-1
related SUSE-SU-2025:4040-1
related SUSE-SU-2025:4043-1
related SUSE-SU-2025:4046-1
related SUSE-SU-2025:4050-1
related SUSE-SU-2025:4056-1
related SUSE-SU-2025:4058-1
related SUSE-SU-2025:4059-1
related SUSE-SU-2025:4062-1
related SUSE-SU-2025:4064-1
related SUSE-SU-2025:4078-1
related SUSE-SU-2025:4123-1
related SUSE-SU-2025:4315-1
related SUSE-SU-2026:20149-1
related SUSE-SU-2026:20164-1
related SUSE-SU-2026:20169-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2025-38617

In the Linux kernel, the following vulnerability has been resolved: net/packet: fix a race in packet_set_ring() and packet_notifier() When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This race and the fix are both similar to that of commit 15fe076edea7 ("net/packet: fix a race in packet_bind() and packet_notifier()"). There too the packet_notifier NETDEV_UP event managed to run while a po->bind_lock critical section had to be temporarily released. And the fix was similarly to temporarily set po->num to zero to keep the socket unhooked until the lock is retaken. The po->bind_lock in packet_set_ring and packet_notifier precede the introduction of git history.

View original source

05 / REFERENCES

Further evidence