CVE-2025-38488

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38488", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.021Z", "datePublished": "2025-07-28T11:21:52.085Z", "dateUpdated": "2026-08-05T12:02:19.784Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:19.784Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free in crypt_message when using async crypto\n\nThe CVE-2024-50047 fix removed asynchronous crypto handling from\ncrypt_message(), assuming all crypto operations are synchronous.\nHowever, when hardware crypto accelerators are used, this can cause\nuse-after-free crashes:\n\n crypt_message()\n // Allocate the creq buffer containing the req\n creq = smb2_get_aead_req(..., &req);\n\n // Async encryption returns -EINPROGRESS immediately\n rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);\n\n // Free creq while async operation is still in progress\n kvfree_sensitive(creq, ...);\n\nHardware crypto modules often implement async AEAD operations for\nperformance. When crypto_aead_encrypt/decrypt() returns -EINPROGRESS,\nthe operation completes asynchronously. Without crypto_wait_req(),\nthe function immediately frees the request buffer, leading to crashes\nwhen the driver later accesses the freed memory.\n\nThis results in a use-after-free condition when the hardware crypto\ndriver later accesses the freed request structure, leading to kernel\ncrashes with NULL pointer dereferences.\n\nThe issue occurs because crypto_alloc_aead() with mask=0 doesn't\nguarantee synchronous operation. Even without CRYPTO_ALG_ASYNC in\nthe mask, async implementations can be selected.\n\nFix by restoring the async crypto handling:\n- DECLARE_CRYPTO_WAIT(wait) for completion tracking\n- aead_request_set_callback() for async completion notification\n- crypto_wait_req() to wait for operation completion\n\nThis ensures the request buffer isn't freed until the crypto operation\ncompletes, whether synchronous or asynchronous, while preserving the\nCVE-2024-50047 fix."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The decrypt path of crypt_message() processes SMB3 transform PDUs received from the remote server (smb3_receive_transform \u2192 receive_encrypted_read/standard \u2192 decrypt_raw_data), and the server itself dictates whether encryption is used via SMB2_SESSION_FLAG_ENCRYPT_DATA/SHI1005_FLAGS_ENCRYPT_DATA, so a remote SMB peer drives the vulnerable code over TCP/445.\nAC:L - There is no race the attacker must win: on any target whose crypto API binds gcm(aes)/ccm(aes) to an async hardware accelerator (CAAM, CCP, Chelsio, HiSilicon, Tegra, STM32 and ~24 other in-tree drivers, ubiquitous on embedded and enterprise hardware), every single encrypted SMB message frees the in-flight request buffer deterministically, and the attacker further controls message size and rate to time heap reuse.\nPR:N - The attacker is the remote SMB server (or an attacker who has compromised it) and holds no privileges whatsoever on the vulnerable client; it can even mandate encryption itself, so no local account or credential on the target is required.\nUI:N - Against an already-mounted share (fstab/autofs/persistent enterprise mounts) the server can emit encrypted responses and unsolicited oplock/lease-break messages that reach crypt_message() with no action by any user on the client.\nS:U - The use-after-free corrupts kernel slab memory within the same security authority as the affected component; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed allocation holds the scatterlist that the crypto driver walks to place decrypted output and the driver's private DMA context, so reallocation of that slab lets the hardware write plaintext into attacker-chosen memory and exposes kernel data, giving an arbitrary-read-grade disclosure primitive.\nI:H - The freed buffer contains req->base.complete and req->base.data, later invoked as req->complete(req->data, err), plus the sg pointers used for output DMA; spraying the freed slab during the accelerator round-trip yields a controlled indirect call and arbitrary kernel writes.\nA:H - Even without exploitation the defect reliably produces a slab use-after-free and NULL-pointer dereference in the crypto completion path, as documented in the changelog, crashing the kernel on every encrypted SMB message."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2ops.c"], "versions": [{"version": "8f14a476abba13144df5434871a7225fd29af633", "lessThan": "5d047b12f86cc3b9fde1171c02d9bccf4dba0632", "status": "affected", "versionType": "git"}, {"version": "ef51c0d544b1518b35364480317ab6d3468f205d", "lessThan": "6550b2bef095d0dd2d2c8390d2ea4c3837028833", "status": "affected", "versionType": "git"}, {"version": "bce966530fd5542bbb422cb45ecb775f7a1a6bc3", "lessThan": "9a1d3e8d40f151c2d5a5f40c410e6e433f62f438", "status": "affected", "versionType": "git"}, {"version": "0809fb86ad13b29e1d6d491364fc7ea4fb545995", "lessThan": "15a0a5de49507062bc3be4014a403d8cea5533de", "status": "affected", "versionType": "git"}, {"version": "b0abcd65ec545701b8793e12bc27dc98042b151a", "lessThan": "2a76bc2b24ed889a689fb1c9015307bf16aafb5b", "status": "affected", "versionType": "git"}, {"version": "b0abcd65ec545701b8793e12bc27dc98042b151a", "lessThan": "8ac90f6824fc44d2e55a82503ddfc95defb19ae0", "status": "affected", "versionType": "git"}, {"version": "b0abcd65ec545701b8793e12bc27dc98042b151a", "lessThan": "b220bed63330c0e1733dc06ea8e75d5b9962b6b6", "status": "affected", "versionType": "git"}, {"version": "538c26d9bf70c90edc460d18c81008a4e555925a", "status": "affected", "versionType": "git"}, {"version": "5.10.237", "lessThan": "5.10.241", "status": "affected", "versionType": "semver"}, {"version": "5.15.181", "lessThan": "5.15.190", "status": "affected", "versionType": "semver"}, {"version": "6.1.128", "lessThan": "6.1.147", "status": "affected", "versionType": "semver"}, {"version": "6.6.57", "lessThan": "6.6.100", "status": "affected", "versionType": "semver"}, {"version": "6.11.4", "lessThan": "6.12", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2ops.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.241", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.190", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.147", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.100", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.40", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.8", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.237", "versionEndExcluding": "5.10.241"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.181", "versionEndExcluding": "5.15.190"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.128", "versionEndExcluding": "6.1.147"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.57", "versionEndExcluding": "6.6.100"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.15.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5d047b12f86cc3b9fde1171c02d9bccf4dba0632"}, {"url": "https://git.kernel.org/stable/c/6550b2bef095d0dd2d2c8390d2ea4c3837028833"}, {"url": "https://git.kernel.org/stable/c/9a1d3e8d40f151c2d5a5f40c410e6e433f62f438"}, {"url": "https://git.kernel.org/stable/c/15a0a5de49507062bc3be4014a403d8cea5533de"}, {"url": "https://git.kernel.org/stable/c/2a76bc2b24ed889a689fb1c9015307bf16aafb5b"}, {"url": "https://git.kernel.org/stable/c/8ac90f6824fc44d2e55a82503ddfc95defb19ae0"}, {"url": "https://git.kernel.org/stable/c/b220bed63330c0e1733dc06ea8e75d5b9962b6b6"}], "title": "smb: client: fix use-after-free in crypt_message when using async crypto", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:38:58.858Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/smb2ops.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5d047b12f86cc3b9fde1171c02d9bccf4dba0632", "status": "affected", "version": "8f14a476abba13144df5434871a7225fd29af633", "versionType": "git"}, {"lessThan": "6550b2bef095d0dd2d2c8390d2ea4c3837028833", "status": "affected", "version": "ef51c0d544b1518b35364480317ab6d3468f205d", "versionType": "git"}, {"lessThan": "9a1d3e8d40f151c2d5a5f40c410e6e433f62f438", "status": "affected", "version": "bce966530fd5542bbb422cb45ecb775f7a1a6bc3", "versionType": "git"}, {"lessThan": "15a0a5de49507062bc3be4014a403d8cea5533de", "status": "affected", "version": "0809fb86ad13b29e1d6d491364fc7ea4fb545995", "versionType": "git"}, {"lessThan": "2a76bc2b24ed889a689fb1c9015307bf16aafb5b", "status": "affected", "version": "b0abcd65ec545701b8793e12bc27dc98042b151a", "versionType": "git"}, {"lessThan": "8ac90f6824fc44d2e55a82503ddfc95defb19ae0", "status": "affected", "version": "b0abcd65ec545701b8793e12bc27dc98042b151a", "versionType": "git"}, {"lessThan": "b220bed63330c0e1733dc06ea8e75d5b9962b6b6", "status": "affected", "version": "b0abcd65ec545701b8793e12bc27dc98042b151a", "versionType": "git"}, {"status": "affected", "version": "538c26d9bf70c90edc460d18c81008a4e555925a", "versionType": "git"}, {"lessThan": "5.10.241", "status": "affected", "version": "5.10.237", "versionType": "semver"}, {"lessThan": "5.15.190", "status": "affected", "version": "5.15.181", "versionType": "semver"}, {"lessThan": "6.1.147", "status": "affected", "version": "6.1.128", "versionType": "semver"}, {"lessThan": "6.6.100", "status": "affected", "version": "6.6.57", "versionType": "semver"}, {"lessThan": "6.12", "status": "affected", "version": "6.11.4", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/smb2ops.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.241", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.190", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.147", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.100", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.40", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "79C9B191-D12F-428B-9EEA-30BDCC83120A", "versionEndExcluding": "5.10.241", "versionStartIncluding": "5.10.237", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "61ADEC7C-D645-4175-8A33-7EB9E14A8FF4", "versionEndExcluding": "5.15.190", "versionStartIncluding": "5.15.181", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8D856FFA-04F3-4A37-9907-A0BCF6B2031E", "versionEndExcluding": "6.1.147", "versionStartIncluding": "6.1.128", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4038CF7-63A2-4668-9428-4300CE199E7F", "versionEndExcluding": "6.6.100", "versionStartIncluding": "6.6.57", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B5676E16-8352-46DA-ADBA-D1030B261D95", "versionEndExcluding": "6.12.40", "versionStartIncluding": "6.11.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C7AFE5B0-F3B1-4D30-B8BF-EDA0385C4746", "versionEndExcluding": "6.15.8", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*", "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*", "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*", "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*", "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*", "matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*", "matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free in crypt_message when using async crypto\n\nThe CVE-2024-50047 fix removed asynchronous crypto handling from\ncrypt_message(), assuming all crypto operations are synchronous.\nHowever, when hardware crypto accelerators are used, this can cause\nuse-after-free crashes:\n\n crypt_message()\n // Allocate the creq buffer containing the req\n creq = smb2_get_aead_req(..., &req);\n\n // Async encryption returns -EINPROGRESS immediately\n rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);\n\n // Free creq while async operation is still in progress\n kvfree_sensitive(creq, ...);\n\nHardware crypto modules often implement async AEAD operations for\nperformance. When crypto_aead_encrypt/decrypt() returns -EINPROGRESS,\nthe operation completes asynchronously. Without crypto_wait_req(),\nthe function immediately frees the request buffer, leading to crashes\nwhen the driver later accesses the freed memory.\n\nThis results in a use-after-free condition when the hardware crypto\ndriver later accesses the freed request structure, leading to kernel\ncrashes with NULL pointer dereferences.\n\nThe issue occurs because crypto_alloc_aead() with mask=0 doesn't\nguarantee synchronous operation. Even without CRYPTO_ALG_ASYNC in\nthe mask, async implementations can be selected.\n\nFix by restoring the async crypto handling:\n- DECLARE_CRYPTO_WAIT(wait) for completion tracking\n- aead_request_set_callback() for async completion notification\n- crypto_wait_req() to wait for operation completion\n\nThis ensures the request buffer isn't freed until the crypto operation\ncompletes, whether synchronous or asynchronous, while preserving the\nCVE-2024-50047 fix."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: correcci\u00f3n del use-after-free en crypt_message al usar criptograf\u00eda as\u00edncrona. La correcci\u00f3n CVE-2024-50047 elimin\u00f3 el manejo de criptograf\u00eda as\u00edncrona de crypt_message(), asumiendo que todas las operaciones de criptograf\u00eda son s\u00edncronas. Sin embargo, cuando se usan aceleradores de criptograf\u00eda de hardware, esto puede causar fallos de use-after-free: crypt_message() // Asignar el b\u00fafer creq que contiene la solicitud creq = smb2_get_aead_req(..., &req); // El cifrado as\u00edncrono devuelve -EINPROGRESS inmediatamente rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req); // Liberar creq mientras la operaci\u00f3n as\u00edncrona a\u00fan est\u00e1 en progreso kvfree_sensitive(creq, ...); Los m\u00f3dulos de criptograf\u00eda de hardware a menudo implementan operaciones AEAD as\u00edncronas para mejorar el rendimiento. Cuando crypto_aead_encrypt/decrypt() devuelve -EINPROGRESS, la operaci\u00f3n se completa de forma as\u00edncrona. Sin crypto_wait_req(), la funci\u00f3n libera inmediatamente el b\u00fafer de solicitud, lo que provoca fallos cuando el controlador accede posteriormente a la memoria liberada. Esto genera una condici\u00f3n de use-after-free cuando el controlador de cifrado de hardware accede posteriormente a la estructura de solicitud liberada, lo que provoca fallos del kernel con desreferencias de punteros NULL. El problema se produce porque crypto_alloc_aead() con mask=0 no garantiza la operaci\u00f3n s\u00edncrona. Incluso sin CRYPTO_ALG_ASYNC en la m\u00e1scara, se pueden seleccionar implementaciones as\u00edncronas. Soluci\u00f3n restaurando el manejo de criptograf\u00eda as\u00edncrona: - DECLARE_CRYPTO_WAIT(wait) para seguimiento de finalizaci\u00f3n - aead_request_set_callback() para notificaci\u00f3n de finalizaci\u00f3n as\u00edncrona - crypto_wait_req() para esperar a que se complete la operaci\u00f3n Esto garantiza que el b\u00fafer de solicitud no se libere hasta que se complete la operaci\u00f3n de criptograf\u00eda, ya sea sincr\u00f3nica o asincr\u00f3nica, al tiempo que se conserva la correcci\u00f3n CVE-2024-50047."}], "id": "CVE-2025-38488", "lastModified": "2026-07-30T06:23:20.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-07-28T12:15:30.857", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/15a0a5de49507062bc3be4014a403d8cea5533de"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2a76bc2b24ed889a689fb1c9015307bf16aafb5b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5d047b12f86cc3b9fde1171c02d9bccf4dba0632"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6550b2bef095d0dd2d2c8390d2ea4c3837028833"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8ac90f6824fc44d2e55a82503ddfc95defb19ae0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9a1d3e8d40f151c2d5a5f40c410e6e433f62f438"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b220bed63330c0e1733dc06ea8e75d5b9962b6b6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: smb: client: fix use-after-free in crypt_message when using async crypto", "id": "2383894", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383894"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-38488", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38488\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38488\nhttps://lore.kernel.org/linux-cve-announce/2025072816-CVE-2025-38488-7f36@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-29T07:59:24.139368+00:00", "updated": "2025-07-29T07:59:24.139447+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}