CVE-2025-38544

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix bug due to prealloc collision When userspace is using AF_RXRPC to provide a server, it has to preallocate incoming calls and assign to them call IDs that will be used to thread related recvmsg() and sendmsg() together. The preallocated call IDs will automatically be attached to calls as they come in until the pool is empty. To the kernel, the call IDs are just arbitrary numbers, but userspace can use the call ID to hold a pointer to prepared structs. In any case, the user isn't permitted to create two calls with the same call ID (call IDs become available again when the call ends) and EBADSLT should result from sendmsg() if an attempt is made to preallocate a call with an in-use call ID. However, the cleanup in the error handling will trigger both assertions in rxrpc_cleanup_call() because the call isn't marked complete and isn't marked as having been released. Fix this by setting the call state in rxrpc_service_prealloc_one() and then marking it as being released before calling the cleanup function.

• CWE-617

• https://git.kernel.org/stable/c/432c5363cd6fe5a928bbc94524d28b05515684ddPatch
• https://git.kernel.org/stable/c/5385ad53793de2ab11e396bdcdaa65bb04b4dad6Patch
• https://git.kernel.org/stable/c/69e4186773c6445b258fb45b6e1df18df831ec45Patch
• https://git.kernel.org/stable/c/d8ffb47a443919277cb093c3db1ec6c0a06880b1Patch

Published

Aug 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-38539In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-3854A vulnerability, which was classified as critical, was found…8.6
• CVE-2025-38540In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38541In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38542In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38543In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38545In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38546In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38547In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-38548In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-38549In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-3855A vulnerability was found in CodeCanyon RISE Ultimate Projec…5.3