CVE-2025-38675: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38675 is a race condition vulnerability in the Linux kernel's xfrm (IPsec transform) state management subsystem, specifically within the xfrm_state_find function. During preemption, xfrm_state_look_at may identify a different per-CPU ID and look up states for another CPU; if a state match is found for CPU2 during a lookup initiated on CPU1, execution jumps to the "found" label while bypassing initialization of state_ptrs, leaving those pointers uninitialized when the "acquire" block is entered. The vulnerability was published on August 22, 2025, and affects Linux kernel versions 6.12.13 through 6.12.40, 6.13.2 through 6.15.8, and 6.16 release candidates (rc1–rc7). It carries a CVSS v3.1 base score of 4.7 (Medium) (Feedly).

The root cause is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization / Race Condition). In xfrm_state_find, the state_ptrs variable is not initialized before the code path that handles preemption-induced CPU ID changes; when a preemption occurs between the CPU ID read and the state cache lookup, the function can jump to the "acquire" block with uninitialized state_ptrs, leading to undefined kernel behavior. The fix initializes state_ptrs immediately after acquiring rcu_read_lock, ensuring the pointers are always valid regardless of which code path is taken. Three patch commits addressing this issue are available on git.kernel.org (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation of this vulnerability by a low-privileged local attacker could cause kernel instability or system crashes, resulting in a denial of service. The impact is limited to availability — there is no confidentiality or integrity impact — and the scope is confined to the affected system without lateral movement potential. Systems using IPsec/xfrm with preemption enabled on multi-CPU configurations are most at risk (Feedly).

The primary remediation is to update the Linux kernel to a patched version: 6.12.41 or later (for the 6.12.x stable branch) or 6.15.9 or later (for the 6.15.x branch). Three patch commits are available on git.kernel.org: 463562f, 6bf2daa, and 94d077c. As a short-term measure, restricting local user access to systems running xfrm/IPsec and minimizing exposure of affected kernel versions reduces risk until patching is feasible (Feedly).

Coverage of CVE-2025-38675 has been limited to standard vulnerability tracking and aggregation platforms, including VulDB, CIRCL Vulnerability Lookup, and security digest sites such as security.sios.jp and pro-linux.de. No notable researcher commentary, vendor statements beyond the kernel patch commits, or significant social media discussion has been observed (Feedly).