CVE-2025-38273

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38273

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: net: tipc: fix refcount warning in tipc_aead_encrypt syzbot reported a refcount warning [1] caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup. The recently added get_net() call in commit e279024617134 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to hold a reference to the network namespace. However, if the namespace is already being destroyed, its refcount might be zero, leading to the use-after-free warning. Replace get_net() with maybe_get_net(), which safely checks if the refcount is non-zero before incrementing it. If the namespace is being destroyed, return -ENODEV early, after releasing the bearer reference. [1]: https://lore.kernel.org/all/[email protected]/T/#m12019cf9ae77e1954f666914640efa36d52704a2

References
Link Resource
https://git.kernel.org/stable/c/307391e8fe70401a6d39ecc9978e13c2c0cdf81f Patch
https://git.kernel.org/stable/c/445d59025d76d0638b03110f8791d5b89ed5162d Patch
https://git.kernel.org/stable/c/9ff60e0d9974dccf24e89bcd3ee7933e538d929f Patch
https://git.kernel.org/stable/c/acab7ca5ff19889b80a8ee7dec220ee1a96dede9 Patch
https://git.kernel.org/stable/c/c762fc79d710d676b793f9d98b1414efe6eb51e6 Patch
https://git.kernel.org/stable/c/e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029 Patch
https://git.kernel.org/stable/c/f29ccaa07cf3d35990f4d25028cc55470d29372b Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory Mailing List
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.10.238:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15.185:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1.141:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6.93:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

18 Dec 2025, 16:58

Type Values Removed Values Added
CWE NVD-CWE-Other
References () https://git.kernel.org/stable/c/307391e8fe70401a6d39ecc9978e13c2c0cdf81f - () https://git.kernel.org/stable/c/307391e8fe70401a6d39ecc9978e13c2c0cdf81f - Patch
References () https://git.kernel.org/stable/c/445d59025d76d0638b03110f8791d5b89ed5162d - () https://git.kernel.org/stable/c/445d59025d76d0638b03110f8791d5b89ed5162d - Patch
References () https://git.kernel.org/stable/c/9ff60e0d9974dccf24e89bcd3ee7933e538d929f - () https://git.kernel.org/stable/c/9ff60e0d9974dccf24e89bcd3ee7933e538d929f - Patch
References () https://git.kernel.org/stable/c/acab7ca5ff19889b80a8ee7dec220ee1a96dede9 - () https://git.kernel.org/stable/c/acab7ca5ff19889b80a8ee7dec220ee1a96dede9 - Patch
References () https://git.kernel.org/stable/c/c762fc79d710d676b793f9d98b1414efe6eb51e6 - () https://git.kernel.org/stable/c/c762fc79d710d676b793f9d98b1414efe6eb51e6 - Patch
References () https://git.kernel.org/stable/c/e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029 - () https://git.kernel.org/stable/c/e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029 - Patch
References () https://git.kernel.org/stable/c/f29ccaa07cf3d35990f4d25028cc55470d29372b - () https://git.kernel.org/stable/c/f29ccaa07cf3d35990f4d25028cc55470d29372b - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory, Mailing List
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory, Mailing List
CPE cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6.93:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.10.238:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15.185:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1.141:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
First Time Linux linux Kernel
Debian
Linux
Debian debian Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

03 Nov 2025, 18:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

10 Jul 2025, 13:17

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: tipc: corrección de la advertencia de recuento de referencias en tipc_aead_encrypt. syzbot reportó una advertencia de recuento de referencias [1] causada por la llamada a get_net() en un espacio de nombres de red que se está destruyendo (recuento de referencias = 0). Esto ocurre cuando se activa un temporizador de descubrimiento de TIPC durante la limpieza del espacio de nombres de red. La llamada a get_net(), recientemente añadida en el commit e279024617134 ("net/tipc: corrección de la lectura de slab-use-after-free en tipc_aead_encrypt_done"), intenta contener una referencia al espacio de nombres de red. Sin embargo, si el espacio de nombres ya se está destruyendo, su recuento de referencias podría ser cero, lo que genera la advertencia de use-after-free. Reemplace get_net() por perhaps_get_net(), que comprueba de forma segura si el recuento de referencias es distinto de cero antes de incrementarlo. Si el espacio de nombres se está destruyendo, devuelva -ENODEV antes de tiempo, después de liberar la referencia del portador. [1]: https://lore.kernel.org/all/[email protected]/T/#m12019cf9ae77e1954f666914640efa36d52704a2

10 Jul 2025, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-10 08:15

Updated : 2025-12-18 16:58

NVD link : CVE-2025-38273

Mitre link : CVE-2025-38273

CVE.ORG link : CVE-2025-38273

JSON object : View

Products Affected

linux

debian

CWE
NVD-CWE-Other