CVE-2025-38464

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_conn_close(). syzbot reported a null-ptr-deref in tipc_conn_close() during netns dismantle. [0] tipc_topsrv_stop() iterates tipc_net(net)->topsrv->conn_idr and calls tipc_conn_close() for each tipc_conn. The problem is that tipc_conn_close() is called after releasing the IDR lock. At the same time, there might be tipc_conn_recv_work() running and it could call tipc_conn_close() for the same tipc_conn and release its last ->kref. Once we release the IDR lock in tipc_topsrv_stop(), there is no...

Affected product and versions

Product

Linux Linux, linux kernel, debian linux

Affected versions

>= c5fa7b3cf3cb22e4ac60485fc2dc187fe012910f < 03dcdd2558e1e55bf843822fe4363dcb48743f2b, >= c5fa7b3cf3cb22e4ac60485fc2dc187fe012910f < 15a6f4971e2f157d57e09ea748d1fbc714277aa4, >= c5fa7b3cf3cb22e4ac60485fc2dc187fe012910f < dab8ded2e5ff41012a6ff400b44dbe76ccf3592a, >= c5fa7b3cf3cb22e4ac60485fc2dc187fe012910f < 1dbf7cd2454a28b1da700085b99346b5445aeabb, >= c5fa7b3cf3cb22e4ac60485fc2dc187fe012910f < be4b8392da7978294f2f368799d29dd509fb6c4d, >= c5fa7b3cf3cb22e4ac60485fc2dc187fe012910f < 50aa2d121bc2cfe2d825f8a331ea75dfaaab6a50, >= c5fa7b3cf3cb22e4ac60485fc2dc187fe012910f < 3b89e17b2fd64012682bed158d9eb3d2e96dec42, >= c5fa7b3cf3cb22e4ac60485fc2dc187fe012910f < 667eeab4999e981c96b447a4df5f20bdf5c26f13, >= 3.11, >= 3.11 < 5.4.296, >= 5.5 < 5.10.240, >= 5.11 < 5.15.189, >= 5.16 < 6.1.146, >= 6.2 < 6.6.99, >= 6.7 < 6.12.39, >= 6.13 < 6.15.7, 6.16, 11.0

Fixed versions

5.4.296, 5.10.240, 5.15.189, 6.1.146, 6.6.99, 6.12.39, 6.15.7

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416