CyberSecBulletin
CVE-2025-38350NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2025-38350 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 3b290923ad2b23596208c1e29520badef4356a43, e9921b57dca05ac5f4fa1fa8e993d4f0ee52e2b7, e269f29e9395527bc00c213c6b15da04ebb35070 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.3% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 3b290923ad2b23596208c1e29520badef4356a43 or e9921b57dca05ac5f4fa1fa8e993d4f0ee52e2b7 or e269f29e9395527bc00c213c6b15da04ebb35070 or 7874c9c132e906a52a187d045995b115973c93fb, whichever matches your release line, or a later version.
  2. Update RUGGEDCOM RST2428P to V3.3 or a later version.
  3. Update SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family to V3.3 or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1034e3310752e8675e313f7271b348914008719a up to, but not including, 3b290923ad2b23596208c1e29520badef4356a43; f9f593e34d2fb67644372c8f7b033bdc622ad228 up to, but not including, e9921b57dca05ac5f4fa1fa8e993d4f0ee52e2b7; 89c301e929a0db14ebd94b4d97764ce1d6981653 up to, but not including, e269f29e9395527bc00c213c6b15da04ebb35070; f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4 up to, but not including, 7874c9c132e906a52a187d045995b115973c93fb; 93c276942e75de0e5bc91576300d292e968f5a02 up to, but not including, f680a4643c6f71e758d8fe0431a958e9a6a4f59d; 49b21795b8e5654a7df3d910a12e1060da4c04cf up to, but not including, a553afd91f55ff39b1e8a1c4989a29394c9e0472; 3f981138109f63232a5fb7165938d4c945cc1b9d up to, but not including, a44acdd9e84a211989ff4b9b92bf3545d8456ad5; 3f981138109f63232a5fb7165938d4c945cc1b9d up to, but not including, 103406b38c600fec1fe375a77b27d87e314aea09; and 9 more ranges3b290923ad2b23596208c1e29520badef4356a43, e9921b57dca05ac5f4fa1fa8e993d4f0ee52e2b7, e269f29e9395527bc00c213c6b15da04ebb35070, 7874c9c132e906a52a187d045995b115973c93fb, f680a4643c6f71e758d8fe0431a958e9a6a4f59d, a553afd91f55ff39b1e8a1c4989a29394c9e0472
SiemensRUGGEDCOM RST2428Pbefore V3.3V3.3
SiemensSCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 familybefore V3.3V3.3
SiemensSCALANCE XCH328before V3.3V3.3
SiemensSCALANCE XCM324before V3.3V3.3
SiemensSCALANCE XCM328before V3.3V3.3
SiemensSCALANCE XCM332before V3.3V3.3
SiemensSCALANCE XRH334 (24 V DC, 8xFO, CC)before V3.3V3.3
SiemensSCALANCE XRM334 (230 V AC, 12xFO)before V3.3V3.3
SiemensSCALANCE XRM334 (230 V AC, 8xFO)before V3.3V3.3
SiemensSCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)before V3.3V3.3
SiemensSCALANCE XRM334 (24 V DC, 12xFO)before V3.3V3.3
SiemensSCALANCE XRM334 (24 V DC, 8xFO)before V3.3V3.3
SiemensSCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)before V3.3V3.3
SiemensSCALANCE XRM334 (2x230 V AC, 12xFO)before V3.3V3.3
SiemensSCALANCE XRM334 (2x230 V AC, 8xFO)before V3.3V3.3
SiemensSCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)before V3.3V3.3
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.5 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.5 and laterNot stated
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFPV3.1.5 and laterNot stated
LinuxLinux Kernel5.4.294 up to, but not including, 5.4.296; 5.10.238 up to, but not including, 5.10.240; 5.15.185 up to, but not including, 5.15.187; 6.1.141 up to, but not including, 6.1.144; 6.6.93 up to, but not including, 6.6.97; 6.12.31 up to, but not including, 6.12.37; 6.14.9 up to, but not including, 6.15; 6.15.1 up to, but not including, 6.15.6; and 2 more ranges5.4.296, 5.10.240, 5.15.187, 6.1.144, 6.6.97, 6.12.37
DebianDebian Linux11.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighCNA
CVSS 3.17.8HighNVD

Official description

In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty Certain classful qdiscs may invoke their classes' dequeue handler on an enqueue operation. This may unexpectedly empty the child qdisc and thus make an in-flight class passive via qlen_notify(). Most qdiscs do not expect such behaviour at this point in time and may re-activate the class eventually anyways which will lead to a use-after-free. The referenced fix commit attempted to fix this behavior for the HFSC case by moving the backlog accounting around, though this turned out to be incomplete since the parent's parent may run into the issue too. The following reproducer demonstrates this use-after-free: tc qdisc add dev lo root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo parent 1: classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: hfsc def 1 tc class add dev lo parent 2: classid 2:1 hfsc rt m1 8 d 1 m2 0 tc qdisc add dev lo parent 2:1 handle 3: netem tc qdisc add dev lo parent 3:1 handle 4: blackhole echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888 tc class delete dev lo classid 1:1 echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888 Since backlog accounting issues leading to a use-after-frees on stale class pointers is a recurring pattern at this point, this patch takes a different approach. Instead of trying to fix the accounting, the patch ensures that qdisc_tree_reduce_backlog always calls qlen_notify when the child qdisc is empty. This solves the problem because deletion of qdiscs always involves a call to qdisc_reset() and / or qdisc_purge_queue() which ultimately resets its qlen to 0 thus causing the following qdisc_tree_reduce_backlog() to report to the parent. Note that this may call qlen_notify on passive classes multiple times. This is not a problem after the recent patch series that made all the classful qdiscs qlen_notify() handlers idempotent.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.