CVE-2025-38717

In the Linux kernel, the following vulnerability has been resolved:

net: kcm: Fix race condition in kcm_unattach()

syzbot found a race condition when kcm_unattach(psock) and kcm_release(kcm) are executed at the same time.

kcm_unattach() is missing a check of the flag kcm->tx_stopped before calling queue_work().

If the kcm has a reserved psock, kcm_unattach() might get executed between cancel_work_sync() and unreserve_psock() in kcm_release(), requeuing kcm->tx_work right before kcm gets freed in kcm_done().

Remove kcm->tx_stopped and replace it by the less error-prone disable_work_sync().

This vulnerability does not present a security risk to supported Red Hat Enterprise Linux releases because the Kernel Connection Multiplexor subsystem is not enabled or compiled in standard shipping kernels. In environments where this functionality is enabled, concurrent socket release and unattachment operations could trigger a race condition that leads to a denial of service or unexpected memory reuse. Supported Red Hat platforms are not affected as the vulnerable code is not included.