CyberSecBulletin
CVE-2025-38459NVD status: Analyzed

Linux: Uncontrolled Recursion

Published Updated By the CyberSecBulletin desk

CVE-2025-38459 is a high-severity uncontrolled recursion vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions f493f31a63847624fd3199ac836a8bd8828e50e2, 125166347d5676466d368aadc0bbc31ee7714352, 5641019dfbaee5e85fe093b590f0451c9dd4d6f8 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.21% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to f493f31a63847624fd3199ac836a8bd8828e50e2 or 125166347d5676466d368aadc0bbc31ee7714352 or 5641019dfbaee5e85fe093b590f0451c9dd4d6f8 or 1579a2777cb914a249de22c789ba4d41b154509f, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.4.296 or 5.10.240 or 5.15.189 or 6.1.146, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, f493f31a63847624fd3199ac836a8bd8828e50e2; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 125166347d5676466d368aadc0bbc31ee7714352; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 5641019dfbaee5e85fe093b590f0451c9dd4d6f8; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 1579a2777cb914a249de22c789ba4d41b154509f; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 3f61b997fe014bbfcc208a9fcbd363a1fe7e3a31; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 024876b247a882972095b22087734dcd23396a4e; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, df0312d8859763aa15b8b56ac151a1ea4a4e5b88; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, c489f3283dbfc0f3c00c312149cae90d27552c45; and 1 more rangesf493f31a63847624fd3199ac836a8bd8828e50e2, 125166347d5676466d368aadc0bbc31ee7714352, 5641019dfbaee5e85fe093b590f0451c9dd4d6f8, 1579a2777cb914a249de22c789ba4d41b154509f, 3f61b997fe014bbfcc208a9fcbd363a1fe7e3a31, 024876b247a882972095b22087734dcd23396a4e
LinuxLinux Kernel2.6.13 up to, but not including, 5.4.296; 5.5 up to, but not including, 5.10.240; 5.11 up to, but not including, 5.15.189; 5.16 up to, but not including, 6.1.146; 6.2 up to, but not including, 6.6.99; 6.7 up to, but not including, 6.12.39; 6.13 up to, but not including, 6.15.7; 2.6.12; and 1 more ranges5.4.296, 5.10.240, 5.15.189, 6.1.146, 6.6.99, 6.12.39
DebianDebian Linux11.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [0] This happens if we call ioctl(ATMARP_MKIP) more than once. During the first call, clip_mkip() sets clip_push() to vcc->push(), and the second call copies it to clip_vcc->old_push(). Later, when the socket is close()d, vcc_destroy_socket() passes NULL skb to clip_push(), which calls clip_vcc->old_push(), triggering the infinite recursion. Let's prevent the second ioctl(ATMARP_MKIP) by checking vcc->user_back, which is allocated by the first call as clip_vcc. Note also that we use lock_sock() to prevent racy calls. [0]: BUG: TASK stack guard page was hit at ffffc9000d66fff8 (stack is ffffc9000d670000..ffffc9000d678000) Oops: stack guard page: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted 6.16.0-rc4-syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:clip_push+0x5/0x720 net/atm/clip.c:191 Code: e0 8f aa 8c e8 1c ad 5b fa eb ae 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <41> 57 41 56 41 55 41 54 53 48 83 ec 20 48 89 f3 49 89 fd 48 bd 00 RSP: 0018:ffffc9000d670000 EFLAGS: 00010246 RAX: 1ffff1100235a4a5 RBX: ffff888011ad2508 RCX: ffff8880003c0000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888037f01000 RBP: dffffc0000000000 R08: ffffffff8fa104f7 R09: 1ffffffff1f4209e R10: dffffc0000000000 R11: ffffffff8a99b300 R12: ffffffff8a99b300 R13: ffff888037f01000 R14: ffff888011ad2500 R15: ffff888037f01578 FS: 000055557ab6d500(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000d66fff8 CR3: 0000000043172000 CR4: 0000000000352ef0 Call Trace: <TASK> clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 ... clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 vcc_destroy_socket net/atm/common.c:183 [inline] vcc_release+0x157/0x460 net/atm/common.c:205 __sock_release net/socket.c:647 [inline] sock_close+0xc0/0x240 net/socket.c:1391 __fput+0x449/0xa70 fs/file_table.c:465 task_work_run+0x1d1/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:114 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff31c98e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fffb5aa1f78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 0000000000012747 RCX: 00007ff31c98e929 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007ff31cbb7ba0 R08: 0000000000000001 R09: 0000000db5aa226f R10: 00007ff31c7ff030 R11: 0000000000000246 R12: 00007ff31cbb608c R13: 00007ff31cbb6080 R14: ffffffffffffffff R15: 00007fffb5aa2090 </TASK> Modules linked in:

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

How developers prevent this class of flaw

  • Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.

More Uncontrolled Recursion vulnerabilities (CWE-674)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Uncontrolled Recursion vulnerabilities

Spotted an error? Tell us.