CVE-2025-38273 (GCVE-0-2025-38273)
Vulnerability from cvelistv5
Published
2025-07-10 07:41
Modified
2025-07-28 04:16
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net: tipc: fix refcount warning in tipc_aead_encrypt syzbot reported a refcount warning [1] caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup. The recently added get_net() call in commit e279024617134 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to hold a reference to the network namespace. However, if the namespace is already being destroyed, its refcount might be zero, leading to the use-after-free warning. Replace get_net() with maybe_get_net(), which safely checks if the refcount is non-zero before incrementing it. If the namespace is being destroyed, return -ENODEV early, after releasing the bearer reference. [1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2
References
Impacted products
Vendor Product Version
Linux Linux Version: d42ed4de6aba232d946d20653a70f79158a6535b
Version: f5c2c4eaaa5a8e7e0685ec031d480e588e263e59
Version: b8fcae6d2e93c54cacb8f579a77d827c1c643eb5
Version: b19fc1d0be3c3397e5968fe2627f22e7f84673b1
Version: 689a205cd968a1572ab561b0c4c2d50a10e9d3b0
Version: e279024617134c94fd3e37470156534d5f2b3472
Version: e279024617134c94fd3e37470156534d5f2b3472
Version: 4a0fddc2c0d5c28aec8c262ad4603be0bef1938c
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "445d59025d76d0638b03110f8791d5b89ed5162d",
              "status": "affected",
              "version": "d42ed4de6aba232d946d20653a70f79158a6535b",
              "versionType": "git"
            },
            {
              "lessThan": "e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029",
              "status": "affected",
              "version": "f5c2c4eaaa5a8e7e0685ec031d480e588e263e59",
              "versionType": "git"
            },
            {
              "lessThan": "307391e8fe70401a6d39ecc9978e13c2c0cdf81f",
              "status": "affected",
              "version": "b8fcae6d2e93c54cacb8f579a77d827c1c643eb5",
              "versionType": "git"
            },
            {
              "lessThan": "acab7ca5ff19889b80a8ee7dec220ee1a96dede9",
              "status": "affected",
              "version": "b19fc1d0be3c3397e5968fe2627f22e7f84673b1",
              "versionType": "git"
            },
            {
              "lessThan": "c762fc79d710d676b793f9d98b1414efe6eb51e6",
              "status": "affected",
              "version": "689a205cd968a1572ab561b0c4c2d50a10e9d3b0",
              "versionType": "git"
            },
            {
              "lessThan": "9ff60e0d9974dccf24e89bcd3ee7933e538d929f",
              "status": "affected",
              "version": "e279024617134c94fd3e37470156534d5f2b3472",
              "versionType": "git"
            },
            {
              "lessThan": "f29ccaa07cf3d35990f4d25028cc55470d29372b",
              "status": "affected",
              "version": "e279024617134c94fd3e37470156534d5f2b3472",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4a0fddc2c0d5c28aec8c262ad4603be0bef1938c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "5.10.238",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "5.15.185",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "6.1.141",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "6.6.93",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.12.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.14.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tipc: fix refcount warning in tipc_aead_encrypt\n\nsyzbot reported a refcount warning [1] caused by calling get_net() on\na network namespace that is being destroyed (refcount=0). This happens\nwhen a TIPC discovery timer fires during network namespace cleanup.\n\nThe recently added get_net() call in commit e279024617134 (\"net/tipc:\nfix slab-use-after-free Read in tipc_aead_encrypt_done\") attempts to\nhold a reference to the network namespace. However, if the namespace\nis already being destroyed, its refcount might be zero, leading to the\nuse-after-free warning.\n\nReplace get_net() with maybe_get_net(), which safely checks if the\nrefcount is non-zero before incrementing it. If the namespace is being\ndestroyed, return -ENODEV early, after releasing the bearer reference.\n\n[1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-28T04:16:55.787Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/445d59025d76d0638b03110f8791d5b89ed5162d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029"
        },
        {
          "url": "https://git.kernel.org/stable/c/307391e8fe70401a6d39ecc9978e13c2c0cdf81f"
        },
        {
          "url": "https://git.kernel.org/stable/c/acab7ca5ff19889b80a8ee7dec220ee1a96dede9"
        },
        {
          "url": "https://git.kernel.org/stable/c/c762fc79d710d676b793f9d98b1414efe6eb51e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ff60e0d9974dccf24e89bcd3ee7933e538d929f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f29ccaa07cf3d35990f4d25028cc55470d29372b"
        }
      ],
      "title": "net: tipc: fix refcount warning in tipc_aead_encrypt",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38273",
    "datePublished": "2025-07-10T07:41:54.415Z",
    "dateReserved": "2025-04-16T04:51:23.998Z",
    "dateUpdated": "2025-07-28T04:16:55.787Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38273\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-10T08:15:25.530\",\"lastModified\":\"2025-07-10T13:17:30.017\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: tipc: fix refcount warning in tipc_aead_encrypt\\n\\nsyzbot reported a refcount warning [1] caused by calling get_net() on\\na network namespace that is being destroyed (refcount=0). This happens\\nwhen a TIPC discovery timer fires during network namespace cleanup.\\n\\nThe recently added get_net() call in commit e279024617134 (\\\"net/tipc:\\nfix slab-use-after-free Read in tipc_aead_encrypt_done\\\") attempts to\\nhold a reference to the network namespace. However, if the namespace\\nis already being destroyed, its refcount might be zero, leading to the\\nuse-after-free warning.\\n\\nReplace get_net() with maybe_get_net(), which safely checks if the\\nrefcount is non-zero before incrementing it. If the namespace is being\\ndestroyed, return -ENODEV early, after releasing the bearer reference.\\n\\n[1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: tipc: correcci\u00f3n de la advertencia de recuento de referencias en tipc_aead_encrypt. syzbot report\u00f3 una advertencia de recuento de referencias [1] causada por la llamada a get_net() en un espacio de nombres de red que se est\u00e1 destruyendo (recuento de referencias = 0). Esto ocurre cuando se activa un temporizador de descubrimiento de TIPC durante la limpieza del espacio de nombres de red. La llamada a get_net(), recientemente a\u00f1adida en el commit e279024617134 (\\\"net/tipc: correcci\u00f3n de la lectura de slab-use-after-free en tipc_aead_encrypt_done\\\"), intenta contener una referencia al espacio de nombres de red. Sin embargo, si el espacio de nombres ya se est\u00e1 destruyendo, su recuento de referencias podr\u00eda ser cero, lo que genera la advertencia de use-after-free. Reemplace get_net() por perhaps_get_net(), que comprueba de forma segura si el recuento de referencias es distinto de cero antes de incrementarlo. Si el espacio de nombres se est\u00e1 destruyendo, devuelva -ENODEV antes de tiempo, despu\u00e9s de liberar la referencia del portador. [1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/307391e8fe70401a6d39ecc9978e13c2c0cdf81f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/445d59025d76d0638b03110f8791d5b89ed5162d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9ff60e0d9974dccf24e89bcd3ee7933e538d929f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/acab7ca5ff19889b80a8ee7dec220ee1a96dede9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c762fc79d710d676b793f9d98b1414efe6eb51e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f29ccaa07cf3d35990f4d25028cc55470d29372b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.