Linux: Use After Free
CVE-2025-38584 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions a2048e475e22b13dc3e53d485b7e6e11464ed9a6, 73f132e60857038416540c3599b1de6033d7575a, 609e59193fc6d9dd323f1c6ae1fdd721f1c79680 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.19% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to a2048e475e22b13dc3e53d485b7e6e11464ed9a6 or 73f132e60857038416540c3599b1de6033d7575a or 609e59193fc6d9dd323f1c6ae1fdd721f1c79680 or a11a12a9880ab37342b73c93cfe1a3ada02ff0db, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.15.10 or 6.16.1, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 16295bec6398a3eedc9377e1af6ff4c71b98c300 up to, but not including, a2048e475e22b13dc3e53d485b7e6e11464ed9a6; 16295bec6398a3eedc9377e1af6ff4c71b98c300 up to, but not including, 73f132e60857038416540c3599b1de6033d7575a; 16295bec6398a3eedc9377e1af6ff4c71b98c300 up to, but not including, 609e59193fc6d9dd323f1c6ae1fdd721f1c79680; 16295bec6398a3eedc9377e1af6ff4c71b98c300 up to, but not including, a11a12a9880ab37342b73c93cfe1a3ada02ff0db; 16295bec6398a3eedc9377e1af6ff4c71b98c300 up to, but not including, f231d5d001ec75f5886c02d496a4c79edc383d45; 16295bec6398a3eedc9377e1af6ff4c71b98c300 up to, but not including, dbe3e911a59bda6de96e7cae387ff882c2c177fa; 16295bec6398a3eedc9377e1af6ff4c71b98c300 up to, but not including, cdf79bd2e1ecb3cc75631c73d8f4149be6019a52; 16295bec6398a3eedc9377e1af6ff4c71b98c300 up to, but not including, 71203f68c7749609d7fc8ae6ad054bdedeb24f91; and 1 more ranges | a2048e475e22b13dc3e53d485b7e6e11464ed9a6, 73f132e60857038416540c3599b1de6033d7575a, 609e59193fc6d9dd323f1c6ae1fdd721f1c79680, a11a12a9880ab37342b73c93cfe1a3ada02ff0db, f231d5d001ec75f5886c02d496a4c79edc383d45, dbe3e911a59bda6de96e7cae387ff882c2c177fa |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | all versions | Not stated |
| Linux | Linux Kernel | 2.6.34 up to, but not including, 6.15.10; 6.16 up to, but not including, 6.16.1 | 6.15.10, 6.16.1 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.0 | High | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: padata: Fix pd UAF once and for all There is a race condition/UAF in padata_reorder that goes back to the initial commit. A reference count is taken at the start of the process in padata_do_parallel, and released at the end in padata_serial_worker. This reference count is (and only is) required for padata_replace to function correctly. If padata_replace is never called then there is no issue. In the function padata_reorder which serves as the core of padata, as soon as padata is added to queue->serial.list, and the associated spin lock released, that padata may be processed and the reference count on pd would go away. Fix this by getting the next padata before the squeue->serial lock is released. In order to make this possible, simplify padata_reorder by only calling it once the next padata arrives.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Other references
- git.kernel.org/stable/c/609e59193fc6d9dd323f1c6ae1fdd721f1c79680
- git.kernel.org/stable/c/73f132e60857038416540c3599b1de6033d7575a
- git.kernel.org/stable/c/a11a12a9880ab37342b73c93cfe1a3ada02ff0db
- git.kernel.org/stable/c/a2048e475e22b13dc3e53d485b7e6e11464ed9a6
- git.kernel.org/stable/c/f231d5d001ec75f5886c02d496a4c79edc383d45
- cert-portal.siemens.com/productcert/html/ssa-784472.html
Recent Use After Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.