Junglewise Threat Intelligence

CVE-2025-38500: Linux Kernel use-after-free in XFRM interface

CVE-2025-38500 · Severity: high · CVSS 7.8 · Published 2025-08-12

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash or potentially execute unauthorized code. The issue occurs when managing specific virtual network interfaces (XFRM) used for secure communications. If an attacker triggers certain configuration changes, it can lead to a 'double free' memory error, resulting in a complete system failure (kernel panic) when the network session is closed.

Technical details

A use-after-free (specifically a double free) vulnerability exists in net/xfrm/xfrm_interface_core.c in the Linux kernel. The root cause is an insufficient validation check in xfrmi_changelink() regarding the 'collect_md' property. While this property should only be set during device creation, the validation logic used xfrmi_locate(), which failed to identify existing collect_md interfaces. This allowed a 'changelink' operation to erroneously insert a special interface into the xfrmi_net->xfrmi hash while it already resided in the collect_md_xfrmi pointer. When the network namespace is subsequently deleted, both pointers are freed, leading to a kernel oops. The fix migrates the check to use netdev_priv, ensuring the property cannot be modified after creation.

Affected products

  • Linux Linux Kernel 6.1 to 6.1.148, 6.2 to 6.6.101, 6.7 to 6.12.41, 6.13 to 6.15.9, 6.16-rc1 to 6.16-rc7

Timeline

  • 2025-07-03: patched: Initial fix authored by Eyal Birger
  • 2025-08-12: advisory: CVE-2025-38500 published

References

Related threats