CVE-2025-38236

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: af_unix: Don't leave consecutive consumed OOB skbs. Jann Horn reported a use-after-free in unix_stream_read_generic(). The following sequences reproduce the issue: $ python3 from socket import * s1, s2 = socketpair(AF_UNIX, SOCK_STREAM) s1.send(b'x', MSG_OOB) s2.recv(1, MSG_OOB) # leave a consumed OOB skb s1.send(b'y', MSG_OOB) s2.recv(1, MSG_OOB) # leave a consumed OOB skb s1.send(b'z', MSG_OOB) s2.recv(1) # recv 'z' illegally s2.recv(1, MSG_OOB) # access 'z' skb (use-after-free) Even though a user reads OOB data, the skb...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= 314001f0bf927015e459c9d387d62a231fe93af3 < 523edfed4f68b7794d85b9ac828c5f8f4442e4c5, >= 314001f0bf927015e459c9d387d62a231fe93af3 < a12237865b48a73183df252029ff5065d73d305e, >= 314001f0bf927015e459c9d387d62a231fe93af3 < fad0a2c16062ac7c606b93166a7ce9d265bab976, >= 314001f0bf927015e459c9d387d62a231fe93af3 < 61a9ad7b69ce688697e5f63332f03e17725353bc, >= 314001f0bf927015e459c9d387d62a231fe93af3 < 8db4d2d026e6e3649832bfe23b96c4acff0756db, >= 314001f0bf927015e459c9d387d62a231fe93af3 < 32ca245464e1479bfea8592b9db227fdc1641705, >= 5.15, >= V3.1.5, >= 5.15 < 5.15.194, >= 5.16 < 6.1.143, >= 6.2 < 6.6.96, >= 6.7 < 6.12.36, >= 6.13 < 6.15.5, 6.16, 11.0

Fixed versions

5.15.194, 6.1.143, 6.6.96, 6.12.36, 6.15.5

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416