CVE-2025-38154 (GCVE-0-2025-38154)
Vulnerability from cvelistv5
Published
2025-07-03 08:35
Modified
2025-07-28 04:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Avoid using sk_socket after free when sending
The sk->sk_socket is not locked or referenced in backlog thread, and
during the call to skb_send_sock(), there is a race condition with
the release of sk_socket. All types of sockets(tcp/udp/unix/vsock)
will be affected.
Race conditions:
'''
CPU0 CPU1
backlog::skb_send_sock
sendmsg_unlocked
sock_sendmsg
sock_sendmsg_nosec
close(fd):
...
ops->release() -> sock_map_close()
sk_socket->ops = NULL
free(socket)
sock->ops->sendmsg
^
panic here
'''
The ref of psock become 0 after sock_map_close() executed.
'''
void sock_map_close()
{
...
if (likely(psock)) {
...
// !! here we remove psock and the ref of psock become 0
sock_map_remove_links(sk, psock)
psock = sk_psock_get(sk);
if (unlikely(!psock))
goto no_psock; <=== Control jumps here via goto
...
cancel_delayed_work_sync(&psock->work); <=== not executed
sk_psock_put(sk, psock);
...
}
'''
Based on the fact that we already wait for the workqueue to finish in
sock_map_close() if psock is held, we simply increase the psock
reference count to avoid race conditions.
With this patch, if the backlog thread is running, sock_map_close() will
wait for the backlog thread to complete and cancel all pending work.
If no backlog running, any pending work that hasn't started by then will
fail when invoked by sk_psock_get(), as the psock reference count have
been zeroed, and sk_psock_drop() will cancel all jobs via
cancel_delayed_work_sync().
In summary, we require synchronization to coordinate the backlog thread
and close() thread.
The panic I catched:
'''
Workqueue: events sk_psock_backlog
RIP: 0010:sock_sendmsg+0x21d/0x440
RAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001
...
Call Trace:
<TASK>
? die_addr+0x40/0xa0
? exc_general_protection+0x14c/0x230
? asm_exc_general_protection+0x26/0x30
? sock_sendmsg+0x21d/0x440
? sock_sendmsg+0x3e0/0x440
? __pfx_sock_sendmsg+0x10/0x10
__skb_send_sock+0x543/0xb70
sk_psock_backlog+0x247/0xb80
...
'''
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ► | Linux | Linux |
Version: 4959ffc65a0e94f8acaac20deac49f89e6ded52d Version: 5eabdf17fed2ad41b836bb4055ec36d95e512c50 Version: e946428439a0d2079959f5603256ac51b6047017 Version: 4b4647add7d3c8530493f7247d11e257ee425bf0 Version: 4b4647add7d3c8530493f7247d11e257ee425bf0 Version: 4b4647add7d3c8530493f7247d11e257ee425bf0 Version: 3627605de498639a3c586c8684d12c89cba11073 |
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/skmsg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4edb40b05cb6a261775abfd8046804ca139a5546",
"status": "affected",
"version": "4959ffc65a0e94f8acaac20deac49f89e6ded52d",
"versionType": "git"
},
{
"lessThan": "b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9",
"status": "affected",
"version": "5eabdf17fed2ad41b836bb4055ec36d95e512c50",
"versionType": "git"
},
{
"lessThan": "4c6fa65ab2aec7df94809478c8d28ef38676a1b7",
"status": "affected",
"version": "e946428439a0d2079959f5603256ac51b6047017",
"versionType": "git"
},
{
"lessThan": "15c0250dae3b48a398447d2b364603821ed4ed90",
"status": "affected",
"version": "4b4647add7d3c8530493f7247d11e257ee425bf0",
"versionType": "git"
},
{
"lessThan": "7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987",
"status": "affected",
"version": "4b4647add7d3c8530493f7247d11e257ee425bf0",
"versionType": "git"
},
{
"lessThan": "8259eb0e06d8f64c700f5fbdb28a5c18e10de291",
"status": "affected",
"version": "4b4647add7d3c8530493f7247d11e257ee425bf0",
"versionType": "git"
},
{
"status": "affected",
"version": "3627605de498639a3c586c8684d12c89cba11073",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/skmsg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.186",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.186",
"versionStartIncluding": "5.15.162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.142",
"versionStartIncluding": "6.1.95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.94",
"versionStartIncluding": "6.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.34",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.3",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Avoid using sk_socket after free when sending\n\nThe sk-\u003esk_socket is not locked or referenced in backlog thread, and\nduring the call to skb_send_sock(), there is a race condition with\nthe release of sk_socket. All types of sockets(tcp/udp/unix/vsock)\nwill be affected.\n\nRace conditions:\n\u0027\u0027\u0027\nCPU0 CPU1\n\nbacklog::skb_send_sock\n sendmsg_unlocked\n sock_sendmsg\n sock_sendmsg_nosec\n close(fd):\n ...\n ops-\u003erelease() -\u003e sock_map_close()\n sk_socket-\u003eops = NULL\n free(socket)\n sock-\u003eops-\u003esendmsg\n ^\n panic here\n\u0027\u0027\u0027\n\nThe ref of psock become 0 after sock_map_close() executed.\n\u0027\u0027\u0027\nvoid sock_map_close()\n{\n ...\n if (likely(psock)) {\n ...\n // !! here we remove psock and the ref of psock become 0\n sock_map_remove_links(sk, psock)\n psock = sk_psock_get(sk);\n if (unlikely(!psock))\n goto no_psock; \u003c=== Control jumps here via goto\n ...\n cancel_delayed_work_sync(\u0026psock-\u003ework); \u003c=== not executed\n sk_psock_put(sk, psock);\n ...\n}\n\u0027\u0027\u0027\n\nBased on the fact that we already wait for the workqueue to finish in\nsock_map_close() if psock is held, we simply increase the psock\nreference count to avoid race conditions.\n\nWith this patch, if the backlog thread is running, sock_map_close() will\nwait for the backlog thread to complete and cancel all pending work.\n\nIf no backlog running, any pending work that hasn\u0027t started by then will\nfail when invoked by sk_psock_get(), as the psock reference count have\nbeen zeroed, and sk_psock_drop() will cancel all jobs via\ncancel_delayed_work_sync().\n\nIn summary, we require synchronization to coordinate the backlog thread\nand close() thread.\n\nThe panic I catched:\n\u0027\u0027\u0027\nWorkqueue: events sk_psock_backlog\nRIP: 0010:sock_sendmsg+0x21d/0x440\nRAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001\n...\nCall Trace:\n \u003cTASK\u003e\n ? die_addr+0x40/0xa0\n ? exc_general_protection+0x14c/0x230\n ? asm_exc_general_protection+0x26/0x30\n ? sock_sendmsg+0x21d/0x440\n ? sock_sendmsg+0x3e0/0x440\n ? __pfx_sock_sendmsg+0x10/0x10\n __skb_send_sock+0x543/0xb70\n sk_psock_backlog+0x247/0xb80\n...\n\u0027\u0027\u0027"
}
],
"providerMetadata": {
"dateUpdated": "2025-07-28T04:13:44.043Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4edb40b05cb6a261775abfd8046804ca139a5546"
},
{
"url": "https://git.kernel.org/stable/c/b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9"
},
{
"url": "https://git.kernel.org/stable/c/4c6fa65ab2aec7df94809478c8d28ef38676a1b7"
},
{
"url": "https://git.kernel.org/stable/c/15c0250dae3b48a398447d2b364603821ed4ed90"
},
{
"url": "https://git.kernel.org/stable/c/7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987"
},
{
"url": "https://git.kernel.org/stable/c/8259eb0e06d8f64c700f5fbdb28a5c18e10de291"
}
],
"title": "bpf, sockmap: Avoid using sk_socket after free when sending",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38154",
"datePublished": "2025-07-03T08:35:57.188Z",
"dateReserved": "2025-04-16T04:51:23.990Z",
"dateUpdated": "2025-07-28T04:13:44.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-38154\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-03T09:15:30.363\",\"lastModified\":\"2025-07-03T15:13:53.147\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf, sockmap: Avoid using sk_socket after free when sending\\n\\nThe sk-\u003esk_socket is not locked or referenced in backlog thread, and\\nduring the call to skb_send_sock(), there is a race condition with\\nthe release of sk_socket. All types of sockets(tcp/udp/unix/vsock)\\nwill be affected.\\n\\nRace conditions:\\n\u0027\u0027\u0027\\nCPU0 CPU1\\n\\nbacklog::skb_send_sock\\n sendmsg_unlocked\\n sock_sendmsg\\n sock_sendmsg_nosec\\n close(fd):\\n ...\\n ops-\u003erelease() -\u003e sock_map_close()\\n sk_socket-\u003eops = NULL\\n free(socket)\\n sock-\u003eops-\u003esendmsg\\n ^\\n panic here\\n\u0027\u0027\u0027\\n\\nThe ref of psock become 0 after sock_map_close() executed.\\n\u0027\u0027\u0027\\nvoid sock_map_close()\\n{\\n ...\\n if (likely(psock)) {\\n ...\\n // !! here we remove psock and the ref of psock become 0\\n sock_map_remove_links(sk, psock)\\n psock = sk_psock_get(sk);\\n if (unlikely(!psock))\\n goto no_psock; \u003c=== Control jumps here via goto\\n ...\\n cancel_delayed_work_sync(\u0026psock-\u003ework); \u003c=== not executed\\n sk_psock_put(sk, psock);\\n ...\\n}\\n\u0027\u0027\u0027\\n\\nBased on the fact that we already wait for the workqueue to finish in\\nsock_map_close() if psock is held, we simply increase the psock\\nreference count to avoid race conditions.\\n\\nWith this patch, if the backlog thread is running, sock_map_close() will\\nwait for the backlog thread to complete and cancel all pending work.\\n\\nIf no backlog running, any pending work that hasn\u0027t started by then will\\nfail when invoked by sk_psock_get(), as the psock reference count have\\nbeen zeroed, and sk_psock_drop() will cancel all jobs via\\ncancel_delayed_work_sync().\\n\\nIn summary, we require synchronization to coordinate the backlog thread\\nand close() thread.\\n\\nThe panic I catched:\\n\u0027\u0027\u0027\\nWorkqueue: events sk_psock_backlog\\nRIP: 0010:sock_sendmsg+0x21d/0x440\\nRAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n ? die_addr+0x40/0xa0\\n ? exc_general_protection+0x14c/0x230\\n ? asm_exc_general_protection+0x26/0x30\\n ? sock_sendmsg+0x21d/0x440\\n ? sock_sendmsg+0x3e0/0x440\\n ? __pfx_sock_sendmsg+0x10/0x10\\n __skb_send_sock+0x543/0xb70\\n sk_psock_backlog+0x247/0xb80\\n...\\n\u0027\u0027\u0027\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf, sockmap: Evite usar sk_socket despu\u00e9s de liberar al enviar El sk-\u0026gt;sk_socket no est\u00e1 bloqueado o referenciado en el hilo del backlog, y durante la llamada a skb_send_sock(), hay una condici\u00f3n de ejecuci\u00f3n con la liberaci\u00f3n de sk_socket. Todos los tipos de sockets (tcp/udp/unix/vsock) se ver\u00e1n afectados. Condiciones de ejecuciones: \u0027\u0027\u0027 CPU0 CPU1 backlog::skb_send_sock sendmsg_unlocked sock_sendmsg sock_sendmsg_nosec close(fd): ... ops-\u0026gt;release() -\u0026gt; sock_map_close() sk_socket-\u0026gt;ops = NULL free(socket) sock-\u0026gt;ops-\u0026gt;sendmsg ^ p\u00e1nico aqu\u00ed \u0027\u0027\u0027 La referencia de psock se convierte en 0 despu\u00e9s de ejecutar sock_map_close(). \u0027\u0027\u0027 void sock_map_close() { ... if (likely(psock)) { ... // !! aqu\u00ed eliminamos psock y la referencia de psock se convierte en 0 sock_map_remove_links(sk, psock) psock = sk_psock_get(sk); if (unlikely(!psock)) goto no_psock; \u0026lt;=== El control salta aqu\u00ed mediante goto ... cancel_delayed_work_sync(\u0026amp;psock-\u0026gt;work); \u0026lt;=== no se ejecuta sk_psock_put(sk, psock); ... } \u0027\u0027\u0027 Bas\u00e1ndonos en el hecho de que ya esperamos a que finalice la cola de trabajo en sock_map_close() si psock est\u00e1 retenido, simplemente aumentamos el recuento de referencias de psock para evitar condiciones de ejecuci\u00f3n. Con este parche, si el hilo de la lista de tareas pendientes se est\u00e1 ejecutando, sock_map_close() esperar\u00e1 a que se complete el hilo de la lista de tareas pendientes y cancelar\u00e1 todo el trabajo pendiente. Si no hay trabajos pendientes en ejecuci\u00f3n, cualquier trabajo pendiente que no haya comenzado para entonces fallar\u00e1 al ser invocado por sk_psock_get(), ya que el recuento de referencias de psock se ha puesto a cero, y sk_psock_drop() cancelar\u00e1 todos los trabajos mediante cancel_delayed_work_sync(). En resumen, necesitamos sincronizaci\u00f3n para coordinar el hilo de trabajo pendiente y el hilo de cierre. El p\u00e1nico que me entr\u00f3: \u0027\u0027\u0027 Workqueue: events sk_psock_backlog RIP: 0010:sock_sendmsg+0x21d/0x440 RAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001 ... Call Trace: ? die_addr+0x40/0xa0 ? exc_general_protection+0x14c/0x230 ? asm_exc_general_protection+0x26/0x30 ? sock_sendmsg+0x21d/0x440 ? sock_sendmsg+0x3e0/0x440 ? __pfx_sock_sendmsg+0x10/0x10 __skb_send_sock+0x543/0xb70 sk_psock_backlog+0x247/0xb80 ... \u0027\u0027\u0027 \"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/15c0250dae3b48a398447d2b364603821ed4ed90\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4c6fa65ab2aec7df94809478c8d28ef38676a1b7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4edb40b05cb6a261775abfd8046804ca139a5546\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8259eb0e06d8f64c700f5fbdb28a5c18e10de291\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…