Executive brief
A vulnerability exists in the Linux kernel's virtual socket (vsock) implementation, which is used for communication between virtual machines and their hosts. A local attacker could exploit this flaw to cause a system crash or potentially execute unauthorized code by triggering a memory error known as a 'use-after-free.' This could lead to a total loss of system availability or compromise the integrity of the operating system.
Technical details
A use-after-free (UAF) vulnerability exists in net/vmw_vsock/af_vsock.c within the Linux kernel. The issue arises because the vsock implementation allowed sockets to autobind to VMADDR_PORT_ANY. When a connection is subsequently made to such a bound socket, or when a socket returned by accept() (which also carries the VMADDR_PORT_ANY port) is bound, it results in an incorrect reference count decrement. This reference count imbalance leads to a use-after-free condition during socket destruction. The fix involves modifying __vsock_bind_connectible() to explicitly prevent binding to VMADDR_PORT_ANY. Patches have been released for multiple stable kernel branches including 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y, and 6.10.y.
Affected products
- Linux Linux Kernel 3.9 to 6.13.y
Timeline
- 2025-08-07: disclosed: Vulnerability reported by Budimir Markovic
- 2025-08-08: patched: Initial patch committed to mainline kernel
- 2025-08-22: advisory: CVE-2025-38618 published
References
- https://git.kernel.org/stable/c/32950b1907919be86a7a2697d6f93d57068b3865
- https://git.kernel.org/stable/c/44bd006d5c93f6a8f28b106cbae2428c5d0275b7
- https://git.kernel.org/stable/c/8f01093646b49f6330bb2d36761983fd829472b1
- https://git.kernel.org/stable/c/aba0c94f61ec05315fa7815d21aefa4c87f6a9f4
- https://git.kernel.org/stable/c/c04a2c1ca25b9b23104124d3b2d349d934e302de
- https://git.kernel.org/stable/c/cf86704798c1b9c46fa59dfc2d662f57d1394d79
- https://git.kernel.org/stable/c/d1a5b1964cef42727668ac0d8532dae4f8c19386