CVE-2025-38273
Description
In the Linux kernel, the following vulnerability has been resolved: net: tipc: fix refcount warning in tipc_aead_encrypt syzbot reported a refcount warning [1] caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup. The recently added get_net() call in commit e279024617134 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to hold a reference to the network namespace. However, if the namespace is already being destroyed, its refcount might be zero, leading to the use-after-free warning. Replace get_net() with maybe_get_net(), which safely checks if the refcount is non-zero before incrementing it. If the namespace is being destroyed, return -ENODEV early, after releasing the bearer reference. [1]: https://lore.kernel.org/all/[email protected]/T/#m12019cf9ae77e1954f666914640efa36d52704a2
How to fix
- linux linux_kernel6.12.34, 6.15, 6.15.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 6.12.31 ≤ v < 6.12.34, 6.14.9 ≤ v < 6.15, 6.15.1 ≤ v < 6.15.3, 5.10.238, 5.15.185, 6.1.141, 6.6.93, 6.15 | 6.12.34, 6.15, 6.15.3 |
| debian debian_linux | 11.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.