Linux: Use After Free
CVE-2025-37786 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 51df5513cca6349d0bea01bab95cd96cf869976e, 6c20894d21600ca1e8549086dfbb986e277bf8a6, fb12b460ec46c9efad98de6d9ba349691db51dc7 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.19% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 51df5513cca6349d0bea01bab95cd96cf869976e or 6c20894d21600ca1e8549086dfbb986e277bf8a6 or fb12b460ec46c9efad98de6d9ba349691db51dc7 or 5c8066fbdb9653c6e9a224bdcd8f9c91a484f0de, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.6.88 or 6.12.25 or 6.14.4, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | c5f51765a1f60b701840544faf3ca63204b8dc3c up to, but not including, 51df5513cca6349d0bea01bab95cd96cf869976e; c5f51765a1f60b701840544faf3ca63204b8dc3c up to, but not including, 6c20894d21600ca1e8549086dfbb986e277bf8a6; c5f51765a1f60b701840544faf3ca63204b8dc3c up to, but not including, fb12b460ec46c9efad98de6d9ba349691db51dc7; c5f51765a1f60b701840544faf3ca63204b8dc3c up to, but not including, 5c8066fbdb9653c6e9a224bdcd8f9c91a484f0de; c5f51765a1f60b701840544faf3ca63204b8dc3c up to, but not including, a038f5f15af455dfe35bc68549e02b950978700a; c5f51765a1f60b701840544faf3ca63204b8dc3c up to, but not including, 8bf108d7161ffc6880ad13a0cc109de3cf631727; 5.5 | 51df5513cca6349d0bea01bab95cd96cf869976e, 6c20894d21600ca1e8549086dfbb986e277bf8a6, fb12b460ec46c9efad98de6d9ba349691db51dc7, 5c8066fbdb9653c6e9a224bdcd8f9c91a484f0de, a038f5f15af455dfe35bc68549e02b950978700a, 8bf108d7161ffc6880ad13a0cc109de3cf631727 |
| Linux | Linux Kernel | 5.5 up to, but not including, 6.6.88; 6.7 up to, but not including, 6.12.25; 6.13 up to, but not including, 6.14.4; 6.15 | 6.6.88, 6.12.25, 6.14.4 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
Official description
In the Linux kernel, the following vulnerability has been resolved: net: dsa: free routing table on probe failure If complete = true in dsa_tree_setup(), it means that we are the last switch of the tree which is successfully probing, and we should be setting up all switches from our probe path. After "complete" becomes true, dsa_tree_setup_cpu_ports() or any subsequent function may fail. If that happens, the entire tree setup is in limbo: the first N-1 switches have successfully finished probing (doing nothing but having allocated persistent memory in the tree's dst->ports, and maybe dst->rtable), and switch N failed to probe, ending the tree setup process before anything is tangible from the user's PoV. If switch N fails to probe, its memory (ports) will be freed and removed from dst->ports. However, the dst->rtable elements pointing to its ports, as created by dsa_link_touch(), will remain there, and will lead to use-after-free if dereferenced. If dsa_tree_setup_switches() returns -EPROBE_DEFER, which is entirely possible because that is where ds->ops->setup() is, we get a kasan report like this: ================================================================== BUG: KASAN: slab-use-after-free in mv88e6xxx_setup_upstream_port+0x240/0x568 Read of size 8 at addr ffff000004f56020 by task kworker/u8:3/42 Call trace: __asan_report_load8_noabort+0x20/0x30 mv88e6xxx_setup_upstream_port+0x240/0x568 mv88e6xxx_setup+0xebc/0x1eb0 dsa_register_switch+0x1af4/0x2ae0 mv88e6xxx_register_switch+0x1b8/0x2a8 mv88e6xxx_probe+0xc4c/0xf60 mdio_probe+0x78/0xb8 really_probe+0x2b8/0x5a8 __driver_probe_device+0x164/0x298 driver_probe_device+0x78/0x258 __device_attach_driver+0x274/0x350 Allocated by task 42: __kasan_kmalloc+0x84/0xa0 __kmalloc_cache_noprof+0x298/0x490 dsa_switch_touch_ports+0x174/0x3d8 dsa_register_switch+0x800/0x2ae0 mv88e6xxx_register_switch+0x1b8/0x2a8 mv88e6xxx_probe+0xc4c/0xf60 mdio_probe+0x78/0xb8 really_probe+0x2b8/0x5a8 __driver_probe_device+0x164/0x298 driver_probe_device+0x78/0x258 __device_attach_driver+0x274/0x350 Freed by task 42: __kasan_slab_free+0x48/0x68 kfree+0x138/0x418 dsa_register_switch+0x2694/0x2ae0 mv88e6xxx_register_switch+0x1b8/0x2a8 mv88e6xxx_probe+0xc4c/0xf60 mdio_probe+0x78/0xb8 really_probe+0x2b8/0x5a8 __driver_probe_device+0x164/0x298 driver_probe_device+0x78/0x258 __device_attach_driver+0x274/0x350 The simplest way to fix the bug is to delete the routing table in its entirety. dsa_tree_setup_routing_table() has no problem in regenerating it even if we deleted links between ports other than those of switch N, because dsa_link_touch() first checks whether the port pair already exists in dst->rtable, allocating if not. The deletion of the routing table in its entirety already exists in dsa_tree_teardown(), so refactor that into a function that can also be called from the tree setup error path. In my analysis of the commit to blame, it is the one which added dsa_link elements to dst->rtable. Prior to that, each switch had its own ds->rtable which is freed when the switch fails to probe. But the tree is potentially persistent memory.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/51df5513cca6349d0bea01bab95cd96cf869976e
- git.kernel.org/stable/c/5c8066fbdb9653c6e9a224bdcd8f9c91a484f0de
- git.kernel.org/stable/c/6c20894d21600ca1e8549086dfbb986e277bf8a6
- git.kernel.org/stable/c/8bf108d7161ffc6880ad13a0cc109de3cf631727
- git.kernel.org/stable/c/a038f5f15af455dfe35bc68549e02b950978700a
- git.kernel.org/stable/c/fb12b460ec46c9efad98de6d9ba349691db51dc7
Recent Use After Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.