CVE-2025-38324: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38324 is a race condition vulnerability in the Linux kernel's MPLS (Multiprotocol Label Switching) routing subsystem, specifically in the mpls_route_input_rcu() function in net/mpls/af_mpls.c. The flaw involves improper RCU (Read-Copy-Update) dereference handling when mpls_route_input_rcu() is called from mpls_getroute() under RTNL lock, causing a suspicious RCU usage warning. Affected kernel versions span from 4.1 through 6.15.3 across multiple stable branches, as well as 6.16-rc1 and rc2; Debian Linux 11.0 is also listed as affected. The vulnerability was published on July 10, 2025, with patches released on December 19, 2025. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is an improper use of rcu_dereference_check() in mpls_route_input_rcu() (CWE-362: Race Condition). When this function is invoked via mpls_getroute(), the caller holds the RTNL mutex rather than an RCU read lock, causing the kernel's lockdep/RCU validator to emit a "suspicious RCU usage" splat because net->mpls.platform_label is accessed without the expected RCU protection context. The fix replaces the standard rcu_dereference() call with rcu_dereference_rtnl(), which correctly accounts for RTNL-held access patterns. Exploitation requires local access and low privileges, as an attacker would need to trigger MPLS route lookup operations via crafted netlink messages (Feedly, Kernel Patches).

Successful exploitation of this vulnerability could lead to kernel memory access issues or system crashes, impacting availability. The vulnerability has no confidentiality or integrity impact (CVSS C:N/I:N/A:H), meaning the primary risk is a denial-of-service condition through kernel instability. Systems running affected kernel versions with MPLS enabled are at risk; the local attack vector limits the blast radius to systems where an attacker already has low-privileged local access (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Update the Linux kernel to a patched version. The fixed versions across stable branches are: 5.4.295 (for 4.1–5.4.x), 5.10.239 (for 5.5–5.10.x), 5.15.186 (for 5.11–5.15.x), 6.1.142 (for 5.16–6.1.x), 6.6.95 (for 6.2–6.6.x), 6.12.35 (for 6.7–6.12.x), and 6.15.4 (for 6.13–6.15.x). Patches were released on December 19, 2025, and are available from git.kernel.org. Debian 11.0 and Amazon Linux 2 users should apply vendor-specific kernel updates. As a secondary measure, disabling MPLS on systems that do not require it can reduce exposure (Feedly, AWS ALAS, Ubuntu USN).

The vulnerability was identified via syzbot automated kernel fuzzing, which generated the suspicious RCU usage report that led to the fix. Multiple Linux distributions including Ubuntu, Amazon Linux 2, and Oracle Linux have issued kernel security advisories addressing this CVE. No notable independent researcher commentary or significant social media discussion has been observed beyond routine vendor patch tracking (AWS ALAS, Ubuntu USN).