CVE-2025-38403

A flaw was found in the Linux kernel's vsock/vmci component. A local attacker with low privileges could exploit a vulnerability where the vmci_transport_packet structure is not properly cleared during initialization. This can lead to the use of uninitialized data, potentially allowing for information disclosure, privilege escalation, or a denial of service (DoS).

This vulnerability is rated Moderate rather than Important because exploitation requires local system access and is restricted to environments utilizing the VMware VMCI transport for virtual socket communications. In typical Red Hat Enterprise Linux deployments, this transport mechanism is only active when virtual machines interact with the hypervisor or other guests via AF_VSOCK on VMware virtualization platforms. Although an unprivileged local user could potentially expose uninitialized kernel memory contents transmitted over this interface, the flaw cannot be triggered remotely or on systems where VMCI communication is absent.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.