CVE-2025-38524: 
Linux Kernel vulnerability analysis and mitigation

A race condition vulnerability was discovered in the Linux kernel's rxrpc subsystem, identified as CVE-2025-38524. The vulnerability was disclosed on August 16, 2025, and affects the recv-recv handling of completed calls in the Linux kernel (NVD CVE).

The vulnerability occurs in the rxrpc subsystem when handling completed calls. When a call receives an event, it gets placed on the socket's queue and a thread in recvmsg is awakened to process it. After the thread picks up the call from the queue, further events cause requeuing, and when the socket lock is dropped, a second thread can attempt to process the same call. This can lead to a race condition where the first thread processes both events and terminates the call, while the second thread, still holding user_mutex, encounters a kernel BUG at net/rxrpc/recvmsg.c:474 (NVD CVE).

The vulnerability can result in a kernel BUG condition, potentially causing system instability or crashes. The issue specifically affects the rxrpc subsystem's handling of socket events and call termination (NVD CVE).

The fix involves modifying the call handling logic to dequeue and ignore calls that are already released, as the user call ID becomes stale in such cases. This prevents the kernel BUG condition from occurring (NVD CVE).