GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38154 (GCVE-0-2025-38154)

Vulnerability from cvelistv5 – Published: 2025-07-03 08:35 – Updated: 2026-08-05 11:59
VLAI
Title
bpf, sockmap: Avoid using sk_socket after free when sending
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Avoid using sk_socket after free when sending The sk->sk_socket is not locked or referenced in backlog thread, and during the call to skb_send_sock(), there is a race condition with the release of sk_socket. All types of sockets(tcp/udp/unix/vsock) will be affected. Race conditions: ''' CPU0 CPU1 backlog::skb_send_sock sendmsg_unlocked sock_sendmsg sock_sendmsg_nosec close(fd): ... ops->release() -> sock_map_close() sk_socket->ops = NULL free(socket) sock->ops->sendmsg ^ panic here ''' The ref of psock become 0 after sock_map_close() executed. ''' void sock_map_close() { ... if (likely(psock)) { ... // !! here we remove psock and the ref of psock become 0 sock_map_remove_links(sk, psock) psock = sk_psock_get(sk); if (unlikely(!psock)) goto no_psock; <=== Control jumps here via goto ... cancel_delayed_work_sync(&psock->work); <=== not executed sk_psock_put(sk, psock); ... } ''' Based on the fact that we already wait for the workqueue to finish in sock_map_close() if psock is held, we simply increase the psock reference count to avoid race conditions. With this patch, if the backlog thread is running, sock_map_close() will wait for the backlog thread to complete and cancel all pending work. If no backlog running, any pending work that hasn't started by then will fail when invoked by sk_psock_get(), as the psock reference count have been zeroed, and sk_psock_drop() will cancel all jobs via cancel_delayed_work_sync(). In summary, we require synchronization to coordinate the backlog thread and close() thread. The panic I catched: ''' Workqueue: events sk_psock_backlog RIP: 0010:sock_sendmsg+0x21d/0x440 RAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001 ... Call Trace: <TASK> ? die_addr+0x40/0xa0 ? exc_general_protection+0x14c/0x230 ? asm_exc_general_protection+0x26/0x30 ? sock_sendmsg+0x21d/0x440 ? sock_sendmsg+0x3e0/0x440 ? __pfx_sock_sendmsg+0x10/0x10 __skb_send_sock+0x543/0xb70 sk_psock_backlog+0x247/0xb80 ... '''
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4959ffc65a0e94f8acaac20deac49f89e6ded52d , < 4edb40b05cb6a261775abfd8046804ca139a5546 (git)
Affected: 5eabdf17fed2ad41b836bb4055ec36d95e512c50 , < b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9 (git)
Affected: e946428439a0d2079959f5603256ac51b6047017 , < 4c6fa65ab2aec7df94809478c8d28ef38676a1b7 (git)
Affected: 4b4647add7d3c8530493f7247d11e257ee425bf0 , < 15c0250dae3b48a398447d2b364603821ed4ed90 (git)
Affected: 4b4647add7d3c8530493f7247d11e257ee425bf0 , < 7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987 (git)
Affected: 4b4647add7d3c8530493f7247d11e257ee425bf0 , < 8259eb0e06d8f64c700f5fbdb28a5c18e10de291 (git)
Affected: 3627605de498639a3c586c8684d12c89cba11073 (git)
Affected: 5.15.162 , < 5.15.186 (semver)
Affected: 6.1.95 , < 6.1.142 (semver)
Affected: 6.6.35 , < 6.6.94 (semver)
Affected: 6.9.6 , < 6.10 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 5.15.186 , ≤ 5.15.* (semver)
Unaffected: 6.1.142 , ≤ 6.1.* (semver)
Unaffected: 6.6.94 , ≤ 6.6.* (semver)
Unaffected: 6.12.34 , ≤ 6.12.* (semver)
Unaffected: 6.15.3 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:34:44.423Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4edb40b05cb6a261775abfd8046804ca139a5546",
              "status": "affected",
              "version": "4959ffc65a0e94f8acaac20deac49f89e6ded52d",
              "versionType": "git"
            },
            {
              "lessThan": "b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9",
              "status": "affected",
              "version": "5eabdf17fed2ad41b836bb4055ec36d95e512c50",
              "versionType": "git"
            },
            {
              "lessThan": "4c6fa65ab2aec7df94809478c8d28ef38676a1b7",
              "status": "affected",
              "version": "e946428439a0d2079959f5603256ac51b6047017",
              "versionType": "git"
            },
            {
              "lessThan": "15c0250dae3b48a398447d2b364603821ed4ed90",
              "status": "affected",
              "version": "4b4647add7d3c8530493f7247d11e257ee425bf0",
              "versionType": "git"
            },
            {
              "lessThan": "7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987",
              "status": "affected",
              "version": "4b4647add7d3c8530493f7247d11e257ee425bf0",
              "versionType": "git"
            },
            {
              "lessThan": "8259eb0e06d8f64c700f5fbdb28a5c18e10de291",
              "status": "affected",
              "version": "4b4647add7d3c8530493f7247d11e257ee425bf0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3627605de498639a3c586c8684d12c89cba11073",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.186",
              "status": "affected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.142",
              "status": "affected",
              "version": "6.1.95",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.94",
              "status": "affected",
              "version": "6.6.35",
              "versionType": "semver"
            },
            {
              "lessThan": "6.10",
              "status": "affected",
              "version": "6.9.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "5.15.162",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "6.1.95",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "6.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.9.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Avoid using sk_socket after free when sending\n\nThe sk-\u003esk_socket is not locked or referenced in backlog thread, and\nduring the call to skb_send_sock(), there is a race condition with\nthe release of sk_socket. All types of sockets(tcp/udp/unix/vsock)\nwill be affected.\n\nRace conditions:\n\u0027\u0027\u0027\nCPU0                               CPU1\n\nbacklog::skb_send_sock\n  sendmsg_unlocked\n    sock_sendmsg\n      sock_sendmsg_nosec\n                                   close(fd):\n                                     ...\n                                     ops-\u003erelease() -\u003e sock_map_close()\n                                     sk_socket-\u003eops = NULL\n                                     free(socket)\n      sock-\u003eops-\u003esendmsg\n            ^\n            panic here\n\u0027\u0027\u0027\n\nThe ref of psock become 0 after sock_map_close() executed.\n\u0027\u0027\u0027\nvoid sock_map_close()\n{\n    ...\n    if (likely(psock)) {\n    ...\n    // !! here we remove psock and the ref of psock become 0\n    sock_map_remove_links(sk, psock)\n    psock = sk_psock_get(sk);\n    if (unlikely(!psock))\n        goto no_psock; \u003c=== Control jumps here via goto\n        ...\n        cancel_delayed_work_sync(\u0026psock-\u003ework); \u003c=== not executed\n        sk_psock_put(sk, psock);\n        ...\n}\n\u0027\u0027\u0027\n\nBased on the fact that we already wait for the workqueue to finish in\nsock_map_close() if psock is held, we simply increase the psock\nreference count to avoid race conditions.\n\nWith this patch, if the backlog thread is running, sock_map_close() will\nwait for the backlog thread to complete and cancel all pending work.\n\nIf no backlog running, any pending work that hasn\u0027t started by then will\nfail when invoked by sk_psock_get(), as the psock reference count have\nbeen zeroed, and sk_psock_drop() will cancel all jobs via\ncancel_delayed_work_sync().\n\nIn summary, we require synchronization to coordinate the backlog thread\nand close() thread.\n\nThe panic I catched:\n\u0027\u0027\u0027\nWorkqueue: events sk_psock_backlog\nRIP: 0010:sock_sendmsg+0x21d/0x440\nRAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001\n...\nCall Trace:\n \u003cTASK\u003e\n ? die_addr+0x40/0xa0\n ? exc_general_protection+0x14c/0x230\n ? asm_exc_general_protection+0x26/0x30\n ? sock_sendmsg+0x21d/0x440\n ? sock_sendmsg+0x3e0/0x440\n ? __pfx_sock_sendmsg+0x10/0x10\n __skb_send_sock+0x543/0xb70\n sk_psock_backlog+0x247/0xb80\n...\n\u0027\u0027\u0027"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is closed by a local `close(fd)` on a sockmap-enrolled socket concurrent with the BPF backlog worker; while remote peer data drives the backlog side, the attacker must be local to control the socket lifetime. BPF/sockmap is Local per kernel scoring guidance.\nAC:L - The attacker controls both sides of the race \u2014 it generates the redirected traffic that schedules `sk_psock_backlog()` and picks the `close()` timing \u2014 and can repeat the attempt in a tight loop until it wins. No condition outside its influence is required.\nPR:L - An unprivileged local process suffices in the real deployments of this feature (Cilium/Istio sockops redirect, BPF-token-delegated containers), where a privileged agent enrols workload sockets into the sockmap and the attacker only needs to send/redirect data and close its own fd.\nUI:N - No victim action is needed; the attacker drives both the traffic and the close from its own process.\nS:U - The use-after-free and any resulting corruption remain within the kernel\u0027s own security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - Use-after-free on `struct socket` \u2014 the freed object can be resprayed from `sock_inode_cachep`, causing redirected payload to be transmitted through a stale/attacker-influenced socket and permitting kernel memory disclosure.\nI:H - `security_socket_sendmsg()` and `READ_ONCE(sock-\u003eops)-\u003esendmsg` dereference and indirect-call through a pointer loaded from freed memory, giving a control-flow hijack primitive once the freed `struct socket` is reclaimed with attacker-groomed contents.\nA:H - The maintainer reproduced a general-protection fault in `sock_sendmsg()` from the `sk_psock_backlog` workqueue; the NULLed `sock-\u003eops` alone guarantees a fatal kernel oops in worker context."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:54.410Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4edb40b05cb6a261775abfd8046804ca139a5546"
        },
        {
          "url": "https://git.kernel.org/stable/c/b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c6fa65ab2aec7df94809478c8d28ef38676a1b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/15c0250dae3b48a398447d2b364603821ed4ed90"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987"
        },
        {
          "url": "https://git.kernel.org/stable/c/8259eb0e06d8f64c700f5fbdb28a5c18e10de291"
        }
      ],
      "title": "bpf, sockmap: Avoid using sk_socket after free when sending",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38154",
    "datePublished": "2025-07-03T08:35:57.188Z",
    "dateReserved": "2025-04-16T04:51:23.990Z",
    "dateUpdated": "2026-08-05T11:59:54.410Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38154",
      "date": "2026-09-17",
      "epss": "0.00164",
      "percentile": "0.06087"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38154\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-03T09:15:30.363\",\"lastModified\":\"2026-07-30T06:22:55.597\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf, sockmap: Avoid using sk_socket after free when sending\\n\\nThe sk-\u003esk_socket is not locked or referenced in backlog thread, and\\nduring the call to skb_send_sock(), there is a race condition with\\nthe release of sk_socket. All types of sockets(tcp/udp/unix/vsock)\\nwill be affected.\\n\\nRace conditions:\\n\u0027\u0027\u0027\\nCPU0                               CPU1\\n\\nbacklog::skb_send_sock\\n  sendmsg_unlocked\\n    sock_sendmsg\\n      sock_sendmsg_nosec\\n                                   close(fd):\\n                                     ...\\n                                     ops-\u003erelease() -\u003e sock_map_close()\\n                                     sk_socket-\u003eops = NULL\\n                                     free(socket)\\n      sock-\u003eops-\u003esendmsg\\n            ^\\n            panic here\\n\u0027\u0027\u0027\\n\\nThe ref of psock become 0 after sock_map_close() executed.\\n\u0027\u0027\u0027\\nvoid sock_map_close()\\n{\\n    ...\\n    if (likely(psock)) {\\n    ...\\n    // !! here we remove psock and the ref of psock become 0\\n    sock_map_remove_links(sk, psock)\\n    psock = sk_psock_get(sk);\\n    if (unlikely(!psock))\\n        goto no_psock; \u003c=== Control jumps here via goto\\n        ...\\n        cancel_delayed_work_sync(\u0026psock-\u003ework); \u003c=== not executed\\n        sk_psock_put(sk, psock);\\n        ...\\n}\\n\u0027\u0027\u0027\\n\\nBased on the fact that we already wait for the workqueue to finish in\\nsock_map_close() if psock is held, we simply increase the psock\\nreference count to avoid race conditions.\\n\\nWith this patch, if the backlog thread is running, sock_map_close() will\\nwait for the backlog thread to complete and cancel all pending work.\\n\\nIf no backlog running, any pending work that hasn\u0027t started by then will\\nfail when invoked by sk_psock_get(), as the psock reference count have\\nbeen zeroed, and sk_psock_drop() will cancel all jobs via\\ncancel_delayed_work_sync().\\n\\nIn summary, we require synchronization to coordinate the backlog thread\\nand close() thread.\\n\\nThe panic I catched:\\n\u0027\u0027\u0027\\nWorkqueue: events sk_psock_backlog\\nRIP: 0010:sock_sendmsg+0x21d/0x440\\nRAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n ? die_addr+0x40/0xa0\\n ? exc_general_protection+0x14c/0x230\\n ? asm_exc_general_protection+0x26/0x30\\n ? sock_sendmsg+0x21d/0x440\\n ? sock_sendmsg+0x3e0/0x440\\n ? __pfx_sock_sendmsg+0x10/0x10\\n __skb_send_sock+0x543/0xb70\\n sk_psock_backlog+0x247/0xb80\\n...\\n\u0027\u0027\u0027\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf, sockmap: Evite usar sk_socket despu\u00e9s de liberar al enviar El sk-\u0026gt;sk_socket no est\u00e1 bloqueado o referenciado en el hilo del backlog, y durante la llamada a skb_send_sock(), hay una condici\u00f3n de ejecuci\u00f3n con la liberaci\u00f3n de sk_socket. Todos los tipos de sockets (tcp/udp/unix/vsock) se ver\u00e1n afectados. Condiciones de ejecuciones: \u0027\u0027\u0027 CPU0 CPU1 backlog::skb_send_sock sendmsg_unlocked sock_sendmsg sock_sendmsg_nosec close(fd): ... ops-\u0026gt;release() -\u0026gt; sock_map_close() sk_socket-\u0026gt;ops = NULL free(socket) sock-\u0026gt;ops-\u0026gt;sendmsg ^ p\u00e1nico aqu\u00ed \u0027\u0027\u0027 La referencia de psock se convierte en 0 despu\u00e9s de ejecutar sock_map_close(). \u0027\u0027\u0027 void sock_map_close() { ... if (likely(psock)) { ... // !! aqu\u00ed eliminamos psock y la referencia de psock se convierte en 0 sock_map_remove_links(sk, psock) psock = sk_psock_get(sk); if (unlikely(!psock)) goto no_psock; \u0026lt;=== El control salta aqu\u00ed mediante goto ... cancel_delayed_work_sync(\u0026amp;psock-\u0026gt;work); \u0026lt;=== no se ejecuta sk_psock_put(sk, psock); ... } \u0027\u0027\u0027 Bas\u00e1ndonos en el hecho de que ya esperamos a que finalice la cola de trabajo en sock_map_close() si psock est\u00e1 retenido, simplemente aumentamos el recuento de referencias de psock para evitar condiciones de ejecuci\u00f3n. Con este parche, si el hilo de la lista de tareas pendientes se est\u00e1 ejecutando, sock_map_close() esperar\u00e1 a que se complete el hilo de la lista de tareas pendientes y cancelar\u00e1 todo el trabajo pendiente. Si no hay trabajos pendientes en ejecuci\u00f3n, cualquier trabajo pendiente que no haya comenzado para entonces fallar\u00e1 al ser invocado por sk_psock_get(), ya que el recuento de referencias de psock se ha puesto a cero, y sk_psock_drop() cancelar\u00e1 todos los trabajos mediante cancel_delayed_work_sync(). En resumen, necesitamos sincronizaci\u00f3n para coordinar el hilo de trabajo pendiente y el hilo de cierre. El p\u00e1nico que me entr\u00f3: \u0027\u0027\u0027 Workqueue: events sk_psock_backlog RIP: 0010:sock_sendmsg+0x21d/0x440 RAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001 ... Call Trace:  ? die_addr+0x40/0xa0 ? exc_general_protection+0x14c/0x230 ? asm_exc_general_protection+0x26/0x30 ? sock_sendmsg+0x21d/0x440 ? sock_sendmsg+0x3e0/0x440 ? __pfx_sock_sendmsg+0x10/0x10 __skb_send_sock+0x543/0xb70 sk_psock_backlog+0x247/0xb80 ... \u0027\u0027\u0027 \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/skmsg.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4959ffc65a0e94f8acaac20deac49f89e6ded52d\",\"lessThan\":\"4edb40b05cb6a261775abfd8046804ca139a5546\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5eabdf17fed2ad41b836bb4055ec36d95e512c50\",\"lessThan\":\"b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e946428439a0d2079959f5603256ac51b6047017\",\"lessThan\":\"4c6fa65ab2aec7df94809478c8d28ef38676a1b7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4b4647add7d3c8530493f7247d11e257ee425bf0\",\"lessThan\":\"15c0250dae3b48a398447d2b364603821ed4ed90\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4b4647add7d3c8530493f7247d11e257ee425bf0\",\"lessThan\":\"7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4b4647add7d3c8530493f7247d11e257ee425bf0\",\"lessThan\":\"8259eb0e06d8f64c700f5fbdb28a5c18e10de291\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3627605de498639a3c586c8684d12c89cba11073\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.162\",\"lessThan\":\"5.15.186\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.95\",\"lessThan\":\"6.1.142\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.35\",\"lessThan\":\"6.6.94\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.9.6\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/skmsg.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.186\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.142\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.94\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.34\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.3\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.162\",\"versionEndExcluding\":\"5.15.186\",\"matchCriteriaId\":\"D435B53D-0FAA-4FE8-A253-D3BB51FB33D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.95\",\"versionEndExcluding\":\"6.1.142\",\"matchCriteriaId\":\"09E3982E-A817-487E-AF93-05C0CE745E45\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.35\",\"versionEndExcluding\":\"6.6.94\",\"matchCriteriaId\":\"B5F01BA1-187F-4D06-B1A6-D43397B8DEBD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9.6\",\"versionEndExcluding\":\"6.10\",\"matchCriteriaId\":\"AEE76B76-CD40-4103-8E82-768D583AB8A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10.1\",\"versionEndExcluding\":\"6.12.34\",\"matchCriteriaId\":\"FB4B0709-0132-4A32-8703-77BDD84FDF62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.3\",\"matchCriteriaId\":\"0541C761-BD5E-4C1A-8432-83B375D7EB92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EA80796-744E-45F5-8632-2AB4F7889FCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3173713D-909A-4DD3-9DD4-1E171EB057EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"79F18AFA-40F7-43F0-BA30-7BDB65F918B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD973AA4-A789-49BD-8D57-B2846935D3C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F3E9E0C-AC3E-4967-AF80-6483E8AB0078\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"11AF4CB9-F697-4EA4-8903-8F9417EFDA8E\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/15c0250dae3b48a398447d2b364603821ed4ed90\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c6fa65ab2aec7df94809478c8d28ef38676a1b7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4edb40b05cb6a261775abfd8046804ca139a5546\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8259eb0e06d8f64c700f5fbdb28a5c18e10de291\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:23:28+00:00",
      "cve": "CVE-2025-38154",
      "id": "CVE-2025-38154",
      "initial_release_date": "2025-07-03T00:00:00+00:00",
      "product_status:fixed": "1256",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Use-after-free in BPF sockmap can lead to denial of service and privilege escalation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38154.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.