Executive brief
A vulnerability in the Linux kernel's cryptographic hashing interface could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs when the system incorrectly handles memory during certain network socket operations, leading to a 'double free' error. This impacts the stability and security of the operating system, potentially allowing an attacker to gain elevated privileges.
Technical details
A double free vulnerability exists in the 'hash_accept' function within 'crypto/algif_hash.c' of the Linux kernel. When the accept(2) system call is invoked on an 'algif_hash' socket with the MSG_MORE flag set, a failure in 'crypto_ahash_import' triggers an explicit free of the socket object (sk2). However, the same object is subsequently freed again during 'af_alg_release', resulting in a slab-use-after-free condition. This local vulnerability requires no user interaction and can be exploited by an attacker with low privileges to compromise kernel memory integrity. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 2.6.38 to 5.4.294, 5.5 to 5.10.238, 5.11 to 5.15.185, 5.16 to 6.1.141, 6.2 to 6.6.93, 6.7 to 6.12.31, 6.13 to 6.14.9, 6.15-rc1 to 6.15-rc7
Timeline
- 2025-05-18: other: Vulnerability fixed in upstream kernel commits
- 2025-06-18: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0346f4b742345d1c733c977f3a7aef5a6419a967
- https://git.kernel.org/stable/c/134daaba93193df9e988524b5cd2f52d15eb1993
- https://git.kernel.org/stable/c/2f45a8d64fb4ed4830a4b3273834ecd6ca504896
- https://git.kernel.org/stable/c/5bff312b59b3f2a54ff504e4f4e47272b64f3633
- https://git.kernel.org/stable/c/b2df03ed4052e97126267e8c13ad4204ea6ba9b6
- https://git.kernel.org/stable/c/bf7bba75b91539e93615f560893a599c1e1c98bf
- https://git.kernel.org/stable/c/c3059d58f79fdfb2201249c2741514e34562b547