---
id: CVE-2025-38462
title: 'vsock: Fix transport_{g2h,h2g} TOCTOU'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vsock: Fix transport_{g2h,h2g} TOCTOU

  vsock_find_cid() and vsock_dev_do_ioctl() may race with module unload.
  transport_{g2h,h2g} may become NULL after the NULL check.
  …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a <
    c5496ee685c48ed1cc183cd4263602579bb4a615
  - >-
    Linux >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a <
    80d7dc15805a93d520a249ac6d13d4f4df161c1b
  - >-
    Linux >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a <
    5752d8dbb3dfd7f1a9faf0f65377e60826ea9a17
  - >-
    Linux >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a <
    401239811fa728fcdd53e360a91f157ffd23e1f4
  - >-
    Linux >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a <
    3734d78210cceb2ee5615719a62a5c55ed381ff8
  - >-
    Linux >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a <
    6a1bcab67bea797d83aa9dd948a0ac6ed52d121d
  - >-
    Linux >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a <
    209fd720838aaf1420416494c5505096478156b4
  - Linux 5.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:57:17.468402Z'
published: '2025-07-25'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:02:39.527Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38462'
references:
  - url: 'https://git.kernel.org/stable/c/c5496ee685c48ed1cc183cd4263602579bb4a615'
  - url: 'https://git.kernel.org/stable/c/80d7dc15805a93d520a249ac6d13d4f4df161c1b'
  - url: 'https://git.kernel.org/stable/c/5752d8dbb3dfd7f1a9faf0f65377e60826ea9a17'
  - url: 'https://git.kernel.org/stable/c/401239811fa728fcdd53e360a91f157ffd23e1f4'
  - url: 'https://git.kernel.org/stable/c/3734d78210cceb2ee5615719a62a5c55ed381ff8'
  - url: 'https://git.kernel.org/stable/c/6a1bcab67bea797d83aa9dd948a0ac6ed52d121d'
  - url: 'https://git.kernel.org/stable/c/209fd720838aaf1420416494c5505096478156b4'
tags:
  - cve.org
epss: 0.00137
epssPercentile: 0.03108
ingestedAt: '2026-11-05T22:38:31.974Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vsock: Fix transport_{g2h,h2g} TOCTOU

vsock_find_cid() and vsock_dev_do_ioctl() may race with module unload.
transport_{g2h,h2g} may become NULL after the NULL check.

Introduce vsock_transport_local_cid() to protect from a potential
null-ptr-deref.

KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
RIP: 0010:vsock_find_cid+0x47/0x90
Call Trace:
 __vsock_bind+0x4b2/0x720
 vsock_bind+0x90/0xe0
 __sys_bind+0x14d/0x1e0
 __x64_sys_bind+0x6e/0xc0
 do_syscall_64+0x92/0x1c0
 entry_SYSCALL_64_after_hwframe+0x4b/0x53

KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
RIP: 0010:vsock_dev_do_ioctl.isra.0+0x58/0xf0
Call Trace:
 __x64_sys_ioctl+0x12d/0x190
 do_syscall_64+0x92/0x1c0
 entry_SYSCALL_64_after_hwframe+0x4b/0x53

## Affected

- `Linux >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a < c5496ee685c48ed1cc183cd4263602579bb4a615`
- `Linux >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a < 80d7dc15805a93d520a249ac6d13d4f4df161c1b`
- `Linux >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a < 5752d8dbb3dfd7f1a9faf0f65377e60826ea9a17`
- `Linux >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a < 401239811fa728fcdd53e360a91f157ffd23e1f4`
- `Linux >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a < 3734d78210cceb2ee5615719a62a5c55ed381ff8`
- `Linux >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a < 6a1bcab67bea797d83aa9dd948a0ac6ed52d121d`
- `Linux >= c0cfa2d8a788fcf45df5bf4070ab2474c88d543a < 209fd720838aaf1420416494c5505096478156b4`
- `Linux 5.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.