CVE-2025-38273
net: tipc: fix refcount warning in tipc_aead_encrypt
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel, the following vulnerability has been resolved: net: tipc: fix refcount warning in tipc_aead_encrypt syzbot reported a refcount warning [1] caused by calling get_net() on
a network namespace that is being destroyed (refcount=0). This happens
when a TIPC discovery timer fires during network namespace cleanup. The recently added get_net() call in commit e279024617134 ("net/tipc:
fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to
hold a reference to the network namespace. However, if the namespace
is already being destroyed, its refcount might be zero, leading to the
use-after-free warning. Replace get_net() with maybe_get_net(), which safely checks if the
refcount is non-zero before incrementing it. If the namespace is being
destroyed, return -ENODEV early, after releasing the bearer reference. [1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2
In the Linux kernel, the following vulnerability has been resolved: net: tipc: fix refcount warning in tipc_aead_encrypt syzbot reported a refcount warning [1] caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup. The recently added get_net() call in commit e279024617134 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to hold a reference to the network namespace. However, if the namespace is already being destroyed, its refcount might be zero, leading to the use-after-free warning. Replace get_net() with maybe_get_net(), which safely checks if the refcount is non-zero before incrementing it. If the namespace is being destroyed, return -ENODEV early, after releasing the bearer reference. [1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2
This update provides the initial livepatch for this kernel update. This update does not contain any fixes and will be updated with livepatches later.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2025-04-16 CVE Reserved
- 2025-07-10 CVE Published
- 2025-07-28 CVE Updated
- 2025-08-11 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (14)
URL | Tag | Source |
---|---|---|
https://git.kernel.org/stable/c/d42ed4de6aba232d946d20653a70f79158a6535b | Vuln. Introduced | |
https://git.kernel.org/stable/c/f5c2c4eaaa5a8e7e0685ec031d480e588e263e59 | Vuln. Introduced | |
https://git.kernel.org/stable/c/b8fcae6d2e93c54cacb8f579a77d827c1c643eb5 | Vuln. Introduced | |
https://git.kernel.org/stable/c/b19fc1d0be3c3397e5968fe2627f22e7f84673b1 | Vuln. Introduced | |
https://git.kernel.org/stable/c/689a205cd968a1572ab561b0c4c2d50a10e9d3b0 | Vuln. Introduced | |
https://git.kernel.org/stable/c/e279024617134c94fd3e37470156534d5f2b3472 | Vuln. Introduced | |
https://git.kernel.org/stable/c/4a0fddc2c0d5c28aec8c262ad4603be0bef1938c | Vuln. Introduced |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.10.238 < 5.10.239 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.10.238 < 5.10.239" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.15.185 < 5.15.186 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.15.185 < 5.15.186" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 6.1.141 < 6.1.142 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.1.141 < 6.1.142" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 6.6.93 < 6.6.94 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.6.93 < 6.6.94" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 6.12.31 < 6.12.34 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.12.31 < 6.12.34" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 6.15 < 6.15.3 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.15 < 6.15.3" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 6.15 < 6.16 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.15 < 6.16" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 6.14.9 Search vendor "Linux" for product "Linux Kernel" and version "6.14.9" | en |
Affected
|