In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix oops due to non-existence of prealloc backlog struct
If an AFRXRPC service socket is opened and bound, but calls are preallocated, then rxrpcallocincomingcall() will oops because the rxrpc_backlog struct doesn't get allocated until the first preallocation is made.
Fix this by returning NULL from rxrpcallocincoming_call() if there is no backlog struct. This will cause the incoming call to be aborted.
[
{
"id": "CVE-2025-38514-0336c2d4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7afb3ff01c42c49e8a143cdce400b95844bb506",
"signature_type": "Line",
"target": {
"file": "net/rxrpc/call_accept.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"295049098256509518296957906318580387410",
"74643106715526304910735915445097596448",
"188639669997653022634866737942311501108"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38514-0cfda844",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7afb3ff01c42c49e8a143cdce400b95844bb506",
"signature_type": "Function",
"target": {
"file": "net/rxrpc/call_accept.c",
"function": "rxrpc_alloc_incoming_call"
},
"deprecated": false,
"digest": {
"length": 1849.0,
"function_hash": "134616599304558709455421948789768907471"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38514-13d090b1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efc1b2b7c1a308b60df8f36bc2d7ce16d3999364",
"signature_type": "Function",
"target": {
"file": "net/rxrpc/call_accept.c",
"function": "rxrpc_alloc_incoming_call"
},
"deprecated": false,
"digest": {
"length": 2123.0,
"function_hash": "212527817771460121810552651529846416611"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38514-2a3290a6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5e72b7824d08c206ce106d30cb37c4642900ccc",
"signature_type": "Function",
"target": {
"file": "net/rxrpc/call_accept.c",
"function": "rxrpc_alloc_incoming_call"
},
"deprecated": false,
"digest": {
"length": 1825.0,
"function_hash": "208773462678791151711929726675750826951"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38514-645d3e11",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efc1b2b7c1a308b60df8f36bc2d7ce16d3999364",
"signature_type": "Line",
"target": {
"file": "net/rxrpc/call_accept.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"295049098256509518296957906318580387410",
"74643106715526304910735915445097596448",
"188639669997653022634866737942311501108"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38514-6d3442c1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@880a88f318cf1d2a0f4c0a7ff7b07e2062b434a4",
"signature_type": "Function",
"target": {
"file": "net/rxrpc/call_accept.c",
"function": "rxrpc_alloc_incoming_call"
},
"deprecated": false,
"digest": {
"length": 2123.0,
"function_hash": "212527817771460121810552651529846416611"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38514-72a69d48",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0eef29385d715d4c7fd707b18d4a9b76c76dd5e6",
"signature_type": "Line",
"target": {
"file": "net/rxrpc/call_accept.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"295049098256509518296957906318580387410",
"74643106715526304910735915445097596448",
"188639669997653022634866737942311501108"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38514-7dc3927e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1ff5f9d2c5405681457262e23c720b08977c11f",
"signature_type": "Line",
"target": {
"file": "net/rxrpc/call_accept.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"295049098256509518296957906318580387410",
"74643106715526304910735915445097596448",
"188639669997653022634866737942311501108"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38514-9e66e490",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0eef29385d715d4c7fd707b18d4a9b76c76dd5e6",
"signature_type": "Function",
"target": {
"file": "net/rxrpc/call_accept.c",
"function": "rxrpc_alloc_incoming_call"
},
"deprecated": false,
"digest": {
"length": 1825.0,
"function_hash": "208773462678791151711929726675750826951"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38514-9f83ae8f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@880a88f318cf1d2a0f4c0a7ff7b07e2062b434a4",
"signature_type": "Line",
"target": {
"file": "net/rxrpc/call_accept.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"295049098256509518296957906318580387410",
"74643106715526304910735915445097596448",
"188639669997653022634866737942311501108"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38514-a3f4ae32",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c2e9ebeb036f9b1b09325ec5cfdfe0e78f357c3",
"signature_type": "Line",
"target": {
"file": "net/rxrpc/call_accept.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"295049098256509518296957906318580387410",
"74643106715526304910735915445097596448",
"188639669997653022634866737942311501108"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38514-b5175192",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf0ca6a1bc4fb904b598137c6718785a107e3adf",
"signature_type": "Function",
"target": {
"file": "net/rxrpc/call_accept.c",
"function": "rxrpc_alloc_incoming_call"
},
"deprecated": false,
"digest": {
"length": 1805.0,
"function_hash": "29705455049113165673651807813346906995"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38514-be5b481f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c2e9ebeb036f9b1b09325ec5cfdfe0e78f357c3",
"signature_type": "Function",
"target": {
"file": "net/rxrpc/call_accept.c",
"function": "rxrpc_alloc_incoming_call"
},
"deprecated": false,
"digest": {
"length": 2123.0,
"function_hash": "212527817771460121810552651529846416611"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38514-c1a42c55",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf0ca6a1bc4fb904b598137c6718785a107e3adf",
"signature_type": "Line",
"target": {
"file": "net/rxrpc/call_accept.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"295049098256509518296957906318580387410",
"74643106715526304910735915445097596448",
"188639669997653022634866737942311501108"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38514-d2ee8d34",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5e72b7824d08c206ce106d30cb37c4642900ccc",
"signature_type": "Line",
"target": {
"file": "net/rxrpc/call_accept.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"295049098256509518296957906318580387410",
"74643106715526304910735915445097596448",
"188639669997653022634866737942311501108"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38514-e293898e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1ff5f9d2c5405681457262e23c720b08977c11f",
"signature_type": "Function",
"target": {
"file": "net/rxrpc/call_accept.c",
"function": "rxrpc_alloc_incoming_call"
},
"deprecated": false,
"digest": {
"length": 2123.0,
"function_hash": "212527817771460121810552651529846416611"
},
"signature_version": "v1"
}
]