CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• debian debian linux11.0
• linux linux kernel5.5 and later · before 5.10.241
• linux linux kernel5.11 and later · before 5.15.190
• linux linux kernel5.16 and later · before 6.1.148
• linux linux kernel6.2 and later · before 6.6.102
• linux linux kernel3.9 and later · before 5.4.297
• linux linux kernel6.13 and later · before 6.15.10
• linux linux kernel6.16 and later · before 6.16.1
• linux linux kernel6.7 and later · before 6.12.42
• linux linux kernel6.17

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 3.9affected
  • d021c344051af91f42c5ba9fdedc176740cbd238 and later · before c04a2c1ca25b9b23104124d3b2d349d934e302deaffected · git
  • d021c344051af91f42c5ba9fdedc176740cbd238 and later · before d1a5b1964cef42727668ac0d8532dae4f8c19386affected · git
  • d021c344051af91f42c5ba9fdedc176740cbd238 and later · before cf86704798c1b9c46fa59dfc2d662f57d1394d79affected · git
  • d021c344051af91f42c5ba9fdedc176740cbd238 and later · before f138be5d7f301fddad4e65ec66dfc3ceebf79be3affected · git
  • d021c344051af91f42c5ba9fdedc176740cbd238 and later · before 44bd006d5c93f6a8f28b106cbae2428c5d0275b7affected · git
  • d021c344051af91f42c5ba9fdedc176740cbd238 and later · before 32950b1907919be86a7a2697d6f93d57068b3865affected · git
  • d021c344051af91f42c5ba9fdedc176740cbd238 and later · before 8f01093646b49f6330bb2d36761983fd829472b1affected · git
  • d021c344051af91f42c5ba9fdedc176740cbd238 and later · before d73960f0cf03ef1dc9e96ec7a20e538accc26d87affected · git
  • d021c344051af91f42c5ba9fdedc176740cbd238 and later · before aba0c94f61ec05315fa7815d21aefa4c87f6a9f4affected · git

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2025-38615Aug 19, 2025 · fs/ntfs3: cancle set bad inode after removing name fails
  22Monitor
• ← EarlierCVE-2025-38616Aug 22, 2025 · tls: handle data disappearing from under the TLS ULP
  28Monitor
• Later →CVE-2025-38619Aug 22, 2025 · media: ti: j721e-csi2rx: fix list_del corruption
  22Monitor

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.