CVE-2025-38588
ipv6: prevent infinite loop in rt6_nlmsg_size()
Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent infinite loop in rt6_nlmsg_size() While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, fib6_siblings) { rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); } This is because fib6_del_route() and fib6_add_rt2node() uses list_del_rcu(), which can confuse rcu readers, because they might no longer see the head of the list. Restart the loop if f6i->fib6_nsiblings is zero.
INFO
Published Date :
Aug. 19, 2025, 5:15 p.m.
Last Modified :
Jan. 7, 2026, 6:44 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update the Linux kernel to the latest version.
- Apply the specific patch for rt6_nlmsg_size.
- Ensure proper handling of RCU list operations.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-38588.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-38588 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-38588
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-38588 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-38588 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jan. 07, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-835 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.11.11 up to (excluding) 6.12 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.16 up to (excluding) 6.16.1 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.15.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.128 up to (excluding) 6.1.148 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.12.2 up to (excluding) 6.12.42 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.6.75 up to (excluding) 6.6.102 Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Added Reference Type kernel.org: https://git.kernel.org/stable/c/3c13db3e47e170bab19e574404e7b6be45ea873d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/46aeb66e9e54ed0d56c18615e1c3dbd502b327ab Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/54e6fe9dd3b0e7c481c2228782c9494d653546da Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6d345136c9b875f065d226908a29c25cdf9343f8 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/cd8d8bbd9ced4cc5d06d858f67d4aa87745e8f38 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e1b7932af47f92432be8303d2439d1bf77b0be23 Types: Patch Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Types: Third Party Advisory -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 03, 2025
Action Type Old Value New Value Added Reference https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 19, 2025
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent infinite loop in rt6_nlmsg_size() While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, fib6_siblings) { rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); } This is because fib6_del_route() and fib6_add_rt2node() uses list_del_rcu(), which can confuse rcu readers, because they might no longer see the head of the list. Restart the loop if f6i->fib6_nsiblings is zero. Added Reference https://git.kernel.org/stable/c/3c13db3e47e170bab19e574404e7b6be45ea873d Added Reference https://git.kernel.org/stable/c/46aeb66e9e54ed0d56c18615e1c3dbd502b327ab Added Reference https://git.kernel.org/stable/c/54e6fe9dd3b0e7c481c2228782c9494d653546da Added Reference https://git.kernel.org/stable/c/6d345136c9b875f065d226908a29c25cdf9343f8 Added Reference https://git.kernel.org/stable/c/cd8d8bbd9ced4cc5d06d858f67d4aa87745e8f38 Added Reference https://git.kernel.org/stable/c/e1b7932af47f92432be8303d2439d1bf77b0be23