CVE-2025-38588

Katalog CVE

CVSS 5.5 · Medium EPSS 0,16%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada linux kernel, debian linux. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent infinite loop in rt6_nlmsg_size() While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, fib6_siblings) { rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); } This is because fib6_del_route() and fib6_add_rt2node() uses list_del_rcu(), which can confuse rcu readers, because they might no longer see the head of the list. Restart the loop if f6i->fib6_nsiblings is zero.

Rincian

Terbit di NVD

19 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/3c13db3e47e170bab19e574404e7b6be45ea873d patch
• https://git.kernel.org/stable/c/46aeb66e9e54ed0d56c18615e1c3dbd502b327ab patch
• https://git.kernel.org/stable/c/54e6fe9dd3b0e7c481c2228782c9494d653546da patch
• https://git.kernel.org/stable/c/6d345136c9b875f065d226908a29c25cdf9343f8 patch
• https://git.kernel.org/stable/c/cd8d8bbd9ced4cc5d06d858f67d4aa87745e8f38 patch
• https://git.kernel.org/stable/c/e1b7932af47f92432be8303d2439d1bf77b0be23 patch
• https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html advisory pihak ketiga