Junglewise Threat Intelligence

CVE-2025-38653: Linux Kernel use-after-free in procfs lseek operation

CVE-2025-38653 · Severity: high · CVSS 7.8 · Published 2025-08-22

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's handling of the /proc file system, which provides information about running processes and system status. Under specific conditions involving the removal of kernel modules, the system may attempt to access memory that has already been freed. This could allow a local attacker to cause a system crash or potentially gain unauthorized access to sensitive information or elevated privileges.

Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel's procfs subsystem within proc_reg_open(). The issue stems from checking pde->proc_ops->proc_lseek directly without proper synchronization or flag-based validation during scenarios where a kernel module is being removed (rmmod). This creates a race condition where the proc_dir_entry (PDE) operations might be accessed after the module providing them has been unloaded. An attacker with local access could exploit this to cause a kernel oops (DoS) or potentially achieve local privilege escalation. The fix involves implementing a flag-based check (PROC_ENTRY_proc_lseek) consistent with how proc_read_iter and other operations are handled to ensure safe access. Patches have been released for various stable branches including 6.1.x, 6.6.x, 6.12.x, 6.15.x, and 6.16.x.

Affected products

  • Linux Linux Kernel 6.0 to 6.1.148, 6.2 to 6.6.102, 6.7 to 6.12.42, 6.13 to 6.15.10, 6.16 to 6.16.1

Timeline

  • 2025-08-22: advisory: NVD publication date
  • 2025-08-15: patched: Fixes committed to stable kernel trees

References

Related threats