CVE-2025-38476

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: rpl: Fix use-after-free in rpl_do_srh_inline(). Running lwt_dst_cache_ref_loop.sh in selftest with KASAN triggers the splat below [0]. rpl_do_srh_inline() fetches ipv6_hdr(skb) and accesses it after skb_cow_head(), which is illegal as the header could be freed then. Let's fix it by making oldhdr to a local struct instead of a pointer. [0]: [root@fedora net]# ./lwt_dst_cache_ref_loop.sh ... TEST: rpl (input) [ 57.631529] ================================================================== BUG: KASAN: slab-use-after-free in rpl...

Affected product and versions

Product

Linux Linux, linux kernel, debian linux

Affected versions

>= a7a29f9c361f8542604ef959ae6627f423b7a412 < c09e21dfc08d8afb92d9ea3bee3457adbe3ef297, >= a7a29f9c361f8542604ef959ae6627f423b7a412 < 8ba6c2362b85089b8972ac5f20b24fc71a4b8ffc, >= a7a29f9c361f8542604ef959ae6627f423b7a412 < e8101506ab86dd78f823b7028f2036a380f3a12a, >= a7a29f9c361f8542604ef959ae6627f423b7a412 < 62dcd9d6e61c39122d2f251a26829e2e55b0a11d, >= a7a29f9c361f8542604ef959ae6627f423b7a412 < 06ec83b6c792fde1f710c1de3e836da6e257c4c4, >= a7a29f9c361f8542604ef959ae6627f423b7a412 < 034b428aa3583373a5a20b1c5931bb2b3cae1f36, >= a7a29f9c361f8542604ef959ae6627f423b7a412 < b640daa2822a39ff76e70200cb2b7b892b896dce, >= 5.7, >= 5.7 < 5.10.241, >= 5.11 < 5.15.190, >= 5.16 < 6.1.147, >= 6.2 < 6.6.100, >= 6.7 < 6.12.40, >= 6.13 < 6.15.8, 6.16, 11.0

Fixed versions

5.10.241, 5.15.190, 6.1.147, 6.6.100, 6.12.40, 6.15.8

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416