CVE-2025-38154

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Avoid using sk_socket after free when sending The sk->sk_socket is not locked or referenced in backlog thread, and during the call to skb_send_sock(), there is a race condition with the release of sk_socket. All types of sockets(tcp/udp/unix/vsock) will be affected. Race conditions: ''' CPU0 CPU1 backlog::skb_send_sock sendmsg_unlocked sock_sendmsg sock_sendmsg_nosec close(fd): ... ops->release() -> sock_map_close() sk_socket->ops = NULL free(socket) sock->ops->sendmsg ^ panic here ''' The ref of psock become...

Affected product and versions

Product

Linux Linux, linux kernel, debian linux

Affected versions

>= 4959ffc65a0e94f8acaac20deac49f89e6ded52d < 4edb40b05cb6a261775abfd8046804ca139a5546, >= 5eabdf17fed2ad41b836bb4055ec36d95e512c50 < b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9, >= e946428439a0d2079959f5603256ac51b6047017 < 4c6fa65ab2aec7df94809478c8d28ef38676a1b7, >= 4b4647add7d3c8530493f7247d11e257ee425bf0 < 15c0250dae3b48a398447d2b364603821ed4ed90, >= 4b4647add7d3c8530493f7247d11e257ee425bf0 < 7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987, >= 4b4647add7d3c8530493f7247d11e257ee425bf0 < 8259eb0e06d8f64c700f5fbdb28a5c18e10de291, >= 3627605de498639a3c586c8684d12c89cba11073, >= 5.15.162 < 5.15.186, >= 6.1.95 < 6.1.142, >= 6.6.35 < 6.6.94, >= 6.9.6 < 6.10, >= 6.10, >= 6.10.1 < 6.12.34, >= 6.13 < 6.15.3, 6.10, 11.0

Fixed versions

5.15.186, 6.1.142, 6.6.94, 6.10, 6.12.34, 6.15.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416