CVE-2025-38154

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38154", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.990Z", "datePublished": "2025-07-03T08:35:57.188Z", "dateUpdated": "2026-10-15T21:52:09.725Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:59:54.410Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Avoid using sk_socket after free when sending\n\nThe sk->sk_socket is not locked or referenced in backlog thread, and\nduring the call to skb_send_sock(), there is a race condition with\nthe release of sk_socket. All types of sockets(tcp/udp/unix/vsock)\nwill be affected.\n\nRace conditions:\n'''\nCPU0 CPU1\n\nbacklog::skb_send_sock\n sendmsg_unlocked\n sock_sendmsg\n sock_sendmsg_nosec\n close(fd):\n ...\n ops->release() -> sock_map_close()\n sk_socket->ops = NULL\n free(socket)\n sock->ops->sendmsg\n ^\n panic here\n'''\n\nThe ref of psock become 0 after sock_map_close() executed.\n'''\nvoid sock_map_close()\n{\n ...\n if (likely(psock)) {\n ...\n // !! here we remove psock and the ref of psock become 0\n sock_map_remove_links(sk, psock)\n psock = sk_psock_get(sk);\n if (unlikely(!psock))\n goto no_psock; <=== Control jumps here via goto\n ...\n cancel_delayed_work_sync(&psock->work); <=== not executed\n sk_psock_put(sk, psock);\n ...\n}\n'''\n\nBased on the fact that we already wait for the workqueue to finish in\nsock_map_close() if psock is held, we simply increase the psock\nreference count to avoid race conditions.\n\nWith this patch, if the backlog thread is running, sock_map_close() will\nwait for the backlog thread to complete and cancel all pending work.\n\nIf no backlog running, any pending work that hasn't started by then will\nfail when invoked by sk_psock_get(), as the psock reference count have\nbeen zeroed, and sk_psock_drop() will cancel all jobs via\ncancel_delayed_work_sync().\n\nIn summary, we require synchronization to coordinate the backlog thread\nand close() thread.\n\nThe panic I catched:\n'''\nWorkqueue: events sk_psock_backlog\nRIP: 0010:sock_sendmsg+0x21d/0x440\nRAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001\n...\nCall Trace:\n <TASK>\n ? die_addr+0x40/0xa0\n ? exc_general_protection+0x14c/0x230\n ? asm_exc_general_protection+0x26/0x30\n ? sock_sendmsg+0x21d/0x440\n ? sock_sendmsg+0x3e0/0x440\n ? __pfx_sock_sendmsg+0x10/0x10\n __skb_send_sock+0x543/0xb70\n sk_psock_backlog+0x247/0xb80\n...\n'''"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The race is closed by a local `close(fd)` on a sockmap-enrolled socket concurrent with the BPF backlog worker; while remote peer data drives the backlog side, the attacker must be local to control the socket lifetime. BPF/sockmap is Local per kernel scoring guidance.\nAC:L - The attacker controls both sides of the race \u2014 it generates the redirected traffic that schedules `sk_psock_backlog()` and picks the `close()` timing \u2014 and can repeat the attempt in a tight loop until it wins. No condition outside its influence is required.\nPR:L - An unprivileged local process suffices in the real deployments of this feature (Cilium/Istio sockops redirect, BPF-token-delegated containers), where a privileged agent enrols workload sockets into the sockmap and the attacker only needs to send/redirect data and close its own fd.\nUI:N - No victim action is needed; the attacker drives both the traffic and the close from its own process.\nS:U - The use-after-free and any resulting corruption remain within the kernel's own security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - Use-after-free on `struct socket` \u2014 the freed object can be resprayed from `sock_inode_cachep`, causing redirected payload to be transmitted through a stale/attacker-influenced socket and permitting kernel memory disclosure.\nI:H - `security_socket_sendmsg()` and `READ_ONCE(sock->ops)->sendmsg` dereference and indirect-call through a pointer loaded from freed memory, giving a control-flow hijack primitive once the freed `struct socket` is reclaimed with attacker-groomed contents.\nA:H - The maintainer reproduced a general-protection fault in `sock_sendmsg()` from the `sk_psock_backlog` workqueue; the NULLed `sock->ops` alone guarantees a fatal kernel oops in worker context."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/skmsg.c"], "versions": [{"version": "4959ffc65a0e94f8acaac20deac49f89e6ded52d", "lessThan": "4edb40b05cb6a261775abfd8046804ca139a5546", "status": "affected", "versionType": "git"}, {"version": "5eabdf17fed2ad41b836bb4055ec36d95e512c50", "lessThan": "b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9", "status": "affected", "versionType": "git"}, {"version": "e946428439a0d2079959f5603256ac51b6047017", "lessThan": "4c6fa65ab2aec7df94809478c8d28ef38676a1b7", "status": "affected", "versionType": "git"}, {"version": "4b4647add7d3c8530493f7247d11e257ee425bf0", "lessThan": "15c0250dae3b48a398447d2b364603821ed4ed90", "status": "affected", "versionType": "git"}, {"version": "4b4647add7d3c8530493f7247d11e257ee425bf0", "lessThan": "7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987", "status": "affected", "versionType": "git"}, {"version": "4b4647add7d3c8530493f7247d11e257ee425bf0", "lessThan": "8259eb0e06d8f64c700f5fbdb28a5c18e10de291", "status": "affected", "versionType": "git"}, {"version": "3627605de498639a3c586c8684d12c89cba11073", "status": "affected", "versionType": "git"}, {"version": "5.15.162", "lessThan": "5.15.186", "status": "affected", "versionType": "semver"}, {"version": "6.1.95", "lessThan": "6.1.142", "status": "affected", "versionType": "semver"}, {"version": "6.6.35", "lessThan": "6.6.94", "status": "affected", "versionType": "semver"}, {"version": "6.9.6", "lessThan": "6.10", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/skmsg.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.186", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.142", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.94", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.34", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.162", "versionEndExcluding": "5.15.186"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.95", "versionEndExcluding": "6.1.142"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.35", "versionEndExcluding": "6.6.94"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.15.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4edb40b05cb6a261775abfd8046804ca139a5546"}, {"url": "https://git.kernel.org/stable/c/b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9"}, {"url": "https://git.kernel.org/stable/c/4c6fa65ab2aec7df94809478c8d28ef38676a1b7"}, {"url": "https://git.kernel.org/stable/c/15c0250dae3b48a398447d2b364603821ed4ed90"}, {"url": "https://git.kernel.org/stable/c/7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987"}, {"url": "https://git.kernel.org/stable/c/8259eb0e06d8f64c700f5fbdb28a5c18e10de291"}], "title": "bpf, sockmap: Avoid using sk_socket after free when sending", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:34:44.423Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38154", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:47:54.370471Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:09.725Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:34:44.423Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38154", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:47:54.370471Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:47:55.270Z"}}], "cna": {"title": "bpf, sockmap: Avoid using sk_socket after free when sending", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The race is closed by a local `close(fd)` on a sockmap-enrolled socket concurrent with the BPF backlog worker; while remote peer data drives the backlog side, the attacker must be local to control the socket lifetime. BPF/sockmap is Local per kernel scoring guidance.\nAC:L - The attacker controls both sides of the race \u2014 it generates the redirected traffic that schedules `sk_psock_backlog()` and picks the `close()` timing \u2014 and can repeat the attempt in a tight loop until it wins. No condition outside its influence is required.\nPR:L - An unprivileged local process suffices in the real deployments of this feature (Cilium/Istio sockops redirect, BPF-token-delegated containers), where a privileged agent enrols workload sockets into the sockmap and the attacker only needs to send/redirect data and close its own fd.\nUI:N - No victim action is needed; the attacker drives both the traffic and the close from its own process.\nS:U - The use-after-free and any resulting corruption remain within the kernel's own security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - Use-after-free on `struct socket` \u2014 the freed object can be resprayed from `sock_inode_cachep`, causing redirected payload to be transmitted through a stale/attacker-influenced socket and permitting kernel memory disclosure.\nI:H - `security_socket_sendmsg()` and `READ_ONCE(sock->ops)->sendmsg` dereference and indirect-call through a pointer loaded from freed memory, giving a control-flow hijack primitive once the freed `struct socket` is reclaimed with attacker-groomed contents.\nA:H - The maintainer reproduced a general-protection fault in `sock_sendmsg()` from the `sk_psock_backlog` workqueue; the NULLed `sock->ops` alone guarantees a fatal kernel oops in worker context."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4959ffc65a0e94f8acaac20deac49f89e6ded52d", "lessThan": "4edb40b05cb6a261775abfd8046804ca139a5546", "versionType": "git"}, {"status": "affected", "version": "5eabdf17fed2ad41b836bb4055ec36d95e512c50", "lessThan": "b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9", "versionType": "git"}, {"status": "affected", "version": "e946428439a0d2079959f5603256ac51b6047017", "lessThan": "4c6fa65ab2aec7df94809478c8d28ef38676a1b7", "versionType": "git"}, {"status": "affected", "version": "4b4647add7d3c8530493f7247d11e257ee425bf0", "lessThan": "15c0250dae3b48a398447d2b364603821ed4ed90", "versionType": "git"}, {"status": "affected", "version": "4b4647add7d3c8530493f7247d11e257ee425bf0", "lessThan": "7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987", "versionType": "git"}, {"status": "affected", "version": "4b4647add7d3c8530493f7247d11e257ee425bf0", "lessThan": "8259eb0e06d8f64c700f5fbdb28a5c18e10de291", "versionType": "git"}, {"status": "affected", "version": "3627605de498639a3c586c8684d12c89cba11073", "versionType": "git"}, {"status": "affected", "version": "5.15.162", "lessThan": "5.15.186", "versionType": "semver"}, {"status": "affected", "version": "6.1.95", "lessThan": "6.1.142", "versionType": "semver"}, {"status": "affected", "version": "6.6.35", "lessThan": "6.6.94", "versionType": "semver"}, {"status": "affected", "version": "6.9.6", "lessThan": "6.10", "versionType": "semver"}], "programFiles": ["net/core/skmsg.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"status": "unaffected", "version": "0", "lessThan": "6.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.186", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.142", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.94", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.34", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.3", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/core/skmsg.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/4edb40b05cb6a261775abfd8046804ca139a5546"}, {"url": "https://git.kernel.org/stable/c/b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9"}, {"url": "https://git.kernel.org/stable/c/4c6fa65ab2aec7df94809478c8d28ef38676a1b7"}, {"url": "https://git.kernel.org/stable/c/15c0250dae3b48a398447d2b364603821ed4ed90"}, {"url": "https://git.kernel.org/stable/c/7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987"}, {"url": "https://git.kernel.org/stable/c/8259eb0e06d8f64c700f5fbdb28a5c18e10de291"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Avoid using sk_socket after free when sending\n\nThe sk->sk_socket is not locked or referenced in backlog thread, and\nduring the call to skb_send_sock(), there is a race condition with\nthe release of sk_socket. All types of sockets(tcp/udp/unix/vsock)\nwill be affected.\n\nRace conditions:\n'''\nCPU0 CPU1\n\nbacklog::skb_send_sock\n sendmsg_unlocked\n sock_sendmsg\n sock_sendmsg_nosec\n close(fd):\n ...\n ops->release() -> sock_map_close()\n sk_socket->ops = NULL\n free(socket)\n sock->ops->sendmsg\n ^\n panic here\n'''\n\nThe ref of psock become 0 after sock_map_close() executed.\n'''\nvoid sock_map_close()\n{\n ...\n if (likely(psock)) {\n ...\n // !! here we remove psock and the ref of psock become 0\n sock_map_remove_links(sk, psock)\n psock = sk_psock_get(sk);\n if (unlikely(!psock))\n goto no_psock; <=== Control jumps here via goto\n ...\n cancel_delayed_work_sync(&psock->work); <=== not executed\n sk_psock_put(sk, psock);\n ...\n}\n'''\n\nBased on the fact that we already wait for the workqueue to finish in\nsock_map_close() if psock is held, we simply increase the psock\nreference count to avoid race conditions.\n\nWith this patch, if the backlog thread is running, sock_map_close() will\nwait for the backlog thread to complete and cancel all pending work.\n\nIf no backlog running, any pending work that hasn't started by then will\nfail when invoked by sk_psock_get(), as the psock reference count have\nbeen zeroed, and sk_psock_drop() will cancel all jobs via\ncancel_delayed_work_sync().\n\nIn summary, we require synchronization to coordinate the backlog thread\nand close() thread.\n\nThe panic I catched:\n'''\nWorkqueue: events sk_psock_backlog\nRIP: 0010:sock_sendmsg+0x21d/0x440\nRAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001\n...\nCall Trace:\n <TASK>\n ? die_addr+0x40/0xa0\n ? exc_general_protection+0x14c/0x230\n ? asm_exc_general_protection+0x26/0x30\n ? sock_sendmsg+0x21d/0x440\n ? sock_sendmsg+0x3e0/0x440\n ? __pfx_sock_sendmsg+0x10/0x10\n __skb_send_sock+0x543/0xb70\n sk_psock_backlog+0x247/0xb80\n...\n'''"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.186", "versionStartIncluding": "5.15.162"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.142", "versionStartIncluding": "6.1.95"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.94", "versionStartIncluding": "6.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.34", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.3", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.9.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:59:54.410Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38154", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:09.725Z", "dateReserved": "2025-04-16T04:51:23.990Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-07-03T08:35:57.188Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/skmsg.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4edb40b05cb6a261775abfd8046804ca139a5546", "status": "affected", "version": "4959ffc65a0e94f8acaac20deac49f89e6ded52d", "versionType": "git"}, {"lessThan": "b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9", "status": "affected", "version": "5eabdf17fed2ad41b836bb4055ec36d95e512c50", "versionType": "git"}, {"lessThan": "4c6fa65ab2aec7df94809478c8d28ef38676a1b7", "status": "affected", "version": "e946428439a0d2079959f5603256ac51b6047017", "versionType": "git"}, {"lessThan": "15c0250dae3b48a398447d2b364603821ed4ed90", "status": "affected", "version": "4b4647add7d3c8530493f7247d11e257ee425bf0", "versionType": "git"}, {"lessThan": "7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987", "status": "affected", "version": "4b4647add7d3c8530493f7247d11e257ee425bf0", "versionType": "git"}, {"lessThan": "8259eb0e06d8f64c700f5fbdb28a5c18e10de291", "status": "affected", "version": "4b4647add7d3c8530493f7247d11e257ee425bf0", "versionType": "git"}, {"status": "affected", "version": "3627605de498639a3c586c8684d12c89cba11073", "versionType": "git"}, {"lessThan": "5.15.186", "status": "affected", "version": "5.15.162", "versionType": "semver"}, {"lessThan": "6.1.142", "status": "affected", "version": "6.1.95", "versionType": "semver"}, {"lessThan": "6.6.94", "status": "affected", "version": "6.6.35", "versionType": "semver"}, {"lessThan": "6.10", "status": "affected", "version": "6.9.6", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/skmsg.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.186", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.142", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.94", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.34", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D435B53D-0FAA-4FE8-A253-D3BB51FB33D6", "versionEndExcluding": "5.15.186", "versionStartIncluding": "5.15.162", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "09E3982E-A817-487E-AF93-05C0CE745E45", "versionEndExcluding": "6.1.142", "versionStartIncluding": "6.1.95", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B5F01BA1-187F-4D06-B1A6-D43397B8DEBD", "versionEndExcluding": "6.6.94", "versionStartIncluding": "6.6.35", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AEE76B76-CD40-4103-8E82-768D583AB8A8", "versionEndExcluding": "6.10", "versionStartIncluding": "6.9.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FB4B0709-0132-4A32-8703-77BDD84FDF62", "versionEndExcluding": "6.12.34", "versionStartIncluding": "6.10.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0541C761-BD5E-4C1A-8432-83B375D7EB92", "versionEndExcluding": "6.15.3", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:-:*:*:*:*:*:*", "matchCriteriaId": "9EA80796-744E-45F5-8632-2AB4F7889FCD", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*", "matchCriteriaId": "331C2F14-12C7-45D5-893D-8C52EE38EA10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*", "matchCriteriaId": "3173713D-909A-4DD3-9DD4-1E171EB057EE", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*", "matchCriteriaId": "79F18AFA-40F7-43F0-BA30-7BDB65F918B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*", "matchCriteriaId": "BD973AA4-A789-49BD-8D57-B2846935D3C7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*", "matchCriteriaId": "8F3E9E0C-AC3E-4967-AF80-6483E8AB0078", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc7:*:*:*:*:*:*", "matchCriteriaId": "11AF4CB9-F697-4EA4-8903-8F9417EFDA8E", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Avoid using sk_socket after free when sending\n\nThe sk->sk_socket is not locked or referenced in backlog thread, and\nduring the call to skb_send_sock(), there is a race condition with\nthe release of sk_socket. All types of sockets(tcp/udp/unix/vsock)\nwill be affected.\n\nRace conditions:\n'''\nCPU0 CPU1\n\nbacklog::skb_send_sock\n sendmsg_unlocked\n sock_sendmsg\n sock_sendmsg_nosec\n close(fd):\n ...\n ops->release() -> sock_map_close()\n sk_socket->ops = NULL\n free(socket)\n sock->ops->sendmsg\n ^\n panic here\n'''\n\nThe ref of psock become 0 after sock_map_close() executed.\n'''\nvoid sock_map_close()\n{\n ...\n if (likely(psock)) {\n ...\n // !! here we remove psock and the ref of psock become 0\n sock_map_remove_links(sk, psock)\n psock = sk_psock_get(sk);\n if (unlikely(!psock))\n goto no_psock; <=== Control jumps here via goto\n ...\n cancel_delayed_work_sync(&psock->work); <=== not executed\n sk_psock_put(sk, psock);\n ...\n}\n'''\n\nBased on the fact that we already wait for the workqueue to finish in\nsock_map_close() if psock is held, we simply increase the psock\nreference count to avoid race conditions.\n\nWith this patch, if the backlog thread is running, sock_map_close() will\nwait for the backlog thread to complete and cancel all pending work.\n\nIf no backlog running, any pending work that hasn't started by then will\nfail when invoked by sk_psock_get(), as the psock reference count have\nbeen zeroed, and sk_psock_drop() will cancel all jobs via\ncancel_delayed_work_sync().\n\nIn summary, we require synchronization to coordinate the backlog thread\nand close() thread.\n\nThe panic I catched:\n'''\nWorkqueue: events sk_psock_backlog\nRIP: 0010:sock_sendmsg+0x21d/0x440\nRAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001\n...\nCall Trace:\n <TASK>\n ? die_addr+0x40/0xa0\n ? exc_general_protection+0x14c/0x230\n ? asm_exc_general_protection+0x26/0x30\n ? sock_sendmsg+0x21d/0x440\n ? sock_sendmsg+0x3e0/0x440\n ? __pfx_sock_sendmsg+0x10/0x10\n __skb_send_sock+0x543/0xb70\n sk_psock_backlog+0x247/0xb80\n...\n'''"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf, sockmap: Evite usar sk_socket despu\u00e9s de liberar al enviar El sk-&gt;sk_socket no est\u00e1 bloqueado o referenciado en el hilo del backlog, y durante la llamada a skb_send_sock(), hay una condici\u00f3n de ejecuci\u00f3n con la liberaci\u00f3n de sk_socket. Todos los tipos de sockets (tcp/udp/unix/vsock) se ver\u00e1n afectados. Condiciones de ejecuciones: ''' CPU0 CPU1 backlog::skb_send_sock sendmsg_unlocked sock_sendmsg sock_sendmsg_nosec close(fd): ... ops-&gt;release() -&gt; sock_map_close() sk_socket-&gt;ops = NULL free(socket) sock-&gt;ops-&gt;sendmsg ^ p\u00e1nico aqu\u00ed ''' La referencia de psock se convierte en 0 despu\u00e9s de ejecutar sock_map_close(). ''' void sock_map_close() { ... if (likely(psock)) { ... // !! aqu\u00ed eliminamos psock y la referencia de psock se convierte en 0 sock_map_remove_links(sk, psock) psock = sk_psock_get(sk); if (unlikely(!psock)) goto no_psock; &lt;=== El control salta aqu\u00ed mediante goto ... cancel_delayed_work_sync(&amp;psock-&gt;work); &lt;=== no se ejecuta sk_psock_put(sk, psock); ... } ''' Bas\u00e1ndonos en el hecho de que ya esperamos a que finalice la cola de trabajo en sock_map_close() si psock est\u00e1 retenido, simplemente aumentamos el recuento de referencias de psock para evitar condiciones de ejecuci\u00f3n. Con este parche, si el hilo de la lista de tareas pendientes se est\u00e1 ejecutando, sock_map_close() esperar\u00e1 a que se complete el hilo de la lista de tareas pendientes y cancelar\u00e1 todo el trabajo pendiente. Si no hay trabajos pendientes en ejecuci\u00f3n, cualquier trabajo pendiente que no haya comenzado para entonces fallar\u00e1 al ser invocado por sk_psock_get(), ya que el recuento de referencias de psock se ha puesto a cero, y sk_psock_drop() cancelar\u00e1 todos los trabajos mediante cancel_delayed_work_sync(). En resumen, necesitamos sincronizaci\u00f3n para coordinar el hilo de trabajo pendiente y el hilo de cierre. El p\u00e1nico que me entr\u00f3: ''' Workqueue: events sk_psock_backlog RIP: 0010:sock_sendmsg+0x21d/0x440 RAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001 ... Call Trace: ? die_addr+0x40/0xa0 ? exc_general_protection+0x14c/0x230 ? asm_exc_general_protection+0x26/0x30 ? sock_sendmsg+0x21d/0x440 ? sock_sendmsg+0x3e0/0x440 ? __pfx_sock_sendmsg+0x10/0x10 __skb_send_sock+0x543/0xb70 sk_psock_backlog+0x247/0xb80 ... ''' "}], "id": "CVE-2025-38154", "lastModified": "2026-10-15T22:18:29.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38154", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:47:54.370471Z", "version": "2.0.3"}}]}, "published": "2025-07-03T09:15:30.363", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/15c0250dae3b48a398447d2b364603821ed4ed90"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4c6fa65ab2aec7df94809478c8d28ef38676a1b7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4edb40b05cb6a261775abfd8046804ca139a5546"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8259eb0e06d8f64c700f5fbdb28a5c18e10de291"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: bpf, sockmap: Avoid using sk_socket after free when sending", "id": "2376056", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376056"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf, sockmap: Avoid using sk_socket after free when sending\nThe sk->sk_socket is not locked or referenced in backlog thread, and\nduring the call to skb_send_sock(), there is a race condition with\nthe release of sk_socket. All types of sockets(tcp/udp/unix/vsock)\nwill be affected.\nRace conditions:\n'''\nCPU0 CPU1\nbacklog::skb_send_sock\nsendmsg_unlocked\nsock_sendmsg\nsock_sendmsg_nosec\nclose(fd):\n...\nops->release() -> sock_map_close()\nsk_socket->ops = NULL\nfree(socket)\nsock->ops->sendmsg\n^\npanic here\n'''\nThe ref of psock become 0 after sock_map_close() executed.\n'''\nvoid sock_map_close()\n{\n...\nif (likely(psock)) {\n...\n// !! here we remove psock and the ref of psock become 0\nsock_map_remove_links(sk, psock)\npsock = sk_psock_get(sk);\nif (unlikely(!psock))\ngoto no_psock; <=== Control jumps here via goto\n...\ncancel_delayed_work_sync(&psock->work); <=== not executed\nsk_psock_put(sk, psock);\n...\n}\n'''\nBased on the fact that we already wait for the workqueue to finish in\nsock_map_close() if psock is held, we simply increase the psock\nreference count to avoid race conditions.\nWith this patch, if the backlog thread is running, sock_map_close() will\nwait for the backlog thread to complete and cancel all pending work.\nIf no backlog running, any pending work that hasn't started by then will\nfail when invoked by sk_psock_get(), as the psock reference count have\nbeen zeroed, and sk_psock_drop() will cancel all jobs via\ncancel_delayed_work_sync().\nIn summary, we require synchronization to coordinate the backlog thread\nand close() thread.\nThe panic I catched:\n'''\nWorkqueue: events sk_psock_backlog\nRIP: 0010:sock_sendmsg+0x21d/0x440\nRAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001\n...\nCall Trace:\n<TASK>\n? die_addr+0x40/0xa0\n? exc_general_protection+0x14c/0x230\n? asm_exc_general_protection+0x26/0x30\n? sock_sendmsg+0x21d/0x440\n? sock_sendmsg+0x3e0/0x440\n? __pfx_sock_sendmsg+0x10/0x10\n__skb_send_sock+0x543/0xb70\nsk_psock_backlog+0x247/0xb80\n...\n'''"], "name": "CVE-2025-38154", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38154\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38154\nhttps://lore.kernel.org/linux-cve-announce/2025070337-CVE-2025-38154-8353@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-06T22:16:21.053352+00:00", "updated": "2025-07-06T22:16:21.053397+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}