CVE-2025-38006net: mctp: Don't access ifa_index when missing
- 5.5MediumCVSS base score
- 0.21%Exploitation in 30 daysEPSS · top 89% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net: mctp: Don't access ifa_index when missing In mctp_dump_addrinfo, ifa_index can be used to filter interfaces, but only when the struct ifaddrmsg is provided. Otherwise it will be comparing to uninitialised memory - reproducible in the syzkaller case from dhcpd, or busybox "ip addr show". The kernel MCTP implementation has always filtered by ifa_index, so existing userspace programs expecting to dump MCTP addresses must already be passing a valid ifa_index value (either 0 or a real index). BUG: KMSAN: uninit-value in mctp_dump_addrinfo+0x208/0xac0 net/mctp/device.c:128 mctp_dump_addrinfo+0x208/0xac0 net/mctp/device.c:128 rtnl_dump_all+0x3ec/0x5b0 net/core/rtnetlink.c:4380 rtnl_dumpit+0xd5/0x2f0 net/core/rtnetlink.c:6824 netlink_dump+0x97b/0x1690 net/netlink/af_netlink.c:2309
Timeline
ID reserved
By Linux
- 2 months later
· 2 months later
Published
- 17 months later
· 17 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.21% · top 89% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 583be982d93479ea3d85091b0fd0b01201ede87d – < 8ef7b3f0db69e2f4a80be351f6aee9a4c2332ef9
- affected 583be982d93479ea3d85091b0fd0b01201ede87d – < d22efcd246a7688599eefcf8e5c7985a3854ef5d
- affected 583be982d93479ea3d85091b0fd0b01201ede87d – < acab78ae12c7fefb4f3bfe22e00770a5faa42724
- affected 583be982d93479ea3d85091b0fd0b01201ede87d – < d4d1561d17eb72908e4489c0900d96e0484fac20
- affected 583be982d93479ea3d85091b0fd0b01201ede87d – < 24fa213dffa470166ec014f979f36c6ff44afb45
- affected 583be982d93479ea3d85091b0fd0b01201ede87d – < f11cf946c0a92c560a890d68e4775723353599e1
- affected 5.15
- unaffected < 5.15
- unaffected 5.15.203 – ≤ 5.15.*
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.92 – ≤ 6.6.*
- unaffected 6.12.30 – ≤ 6.12.*
- unaffected 6.14.8 – ≤ 6.14.*
- unaffected 6.15 – ≤ *
References
References6
- https://git.kernel.org/stable/c/8ef7b3f0db69e2f4a80be351f6aee9a4c2332ef9 (opens in a new tab)
- https://git.kernel.org/stable/c/d22efcd246a7688599eefcf8e5c7985a3854ef5d (opens in a new tab)
- https://git.kernel.org/stable/c/acab78ae12c7fefb4f3bfe22e00770a5faa42724 (opens in a new tab)
- https://git.kernel.org/stable/c/d4d1561d17eb72908e4489c0900d96e0484fac20 (opens in a new tab)
- https://git.kernel.org/stable/c/24fa213dffa470166ec014f979f36c6ff44afb45 (opens in a new tab)
- https://git.kernel.org/stable/c/f11cf946c0a92c560a890d68e4775723353599e1 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-27859 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-38006)Record last updated .