Junglewise Threat Intelligence

CVE-2025-38212: Linux Kernel use-after-free in IPC shm_destroy_orphaned

CVE-2025-38212 · Severity: high · CVSS 7.8 · Published 2025-07-04

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was found in the Linux kernel's Inter-Process Communication (IPC) system, which manages how different programs share data. A local attacker could exploit this flaw to cause a system crash or potentially gain unauthorized access to sensitive information. This issue affects various versions of the Linux kernel and has been addressed in recent security updates.

Technical details

A use-after-free vulnerability exists in the Linux kernel's IPC subsystem within the shm_destroy_orphaned() function. The root cause is that idr_for_each() is only protected by a read-write semaphore (rwsem), which is insufficient to prevent a race condition when radix_tree_node_free() is called via call_rcu(). Without an RCU read-critical region, a node may be freed immediately while the iterator is still attempting to access the next slot, leading to a use-after-free. An attacker with local access can exploit this to trigger memory corruption, system instability, or information disclosure. The fix involves wrapping the idr_for_each() call within rcu_read_lock() and rcu_read_unlock() blocks.

Affected products

  • Linux Linux Kernel 3.1 to 5.4.295, 5.5 to 5.10.239, 5.11 to 5.15.186, 5.16 to 6.1.142, 6.2 to 6.6.95, 6.7 to 6.12.35, 6.13 to 6.15.4

Timeline

  • 2025-04-24: other: Vulnerability reported by syzbot
  • 2025-06-27: patched: Fix committed to various stable kernel branches
  • 2025-07-04: advisory: CVE-2025-38212 published

References

Related threats