CVE-2025-38076

Estado: AnalizadaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

alloc_tag: allocate percpu counters for module tags dynamically

When a module gets unloaded it checks whether any of its tags are still in use and if so, we keep the memory containing module's allocation tags alive until all tags are unused. However percpu counters referenced by the tags are freed by free_module(). This will lead to UAF if the memory allocated by a module is accessed after module was unloaded.

To fix this we allocate percpu counters for module allocation tags dynamically and we keep it alive for tags which are still in use after module unloading.

Leer descripción completaMostrar menos

This also removes the requirement of a larger PERCPU_MODULE_RESERVE when memory allocation profiling is enabled because percpu memory for counters does not need to be reserved anymore.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.18%
Percentil entre todas las CVEs puntuadas: 7
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation75 %
Impacto principalT1059 Command and Scripting Interpreterexecution65 %

CVE-2025-38076 es una UAF en el kernel de Linux (AV:L, PR:L, acceso local con privilegios) que permite ejecución de código arbitrario tras la descarga de módulos; la pista sugiere T1068 (escalada) e impacto T1059 (ejecución).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution Prevention Threat Intelligence Program Restrict Web-Based Content Privileged Account Management Limit Software Installation Behavior Prevention on Endpoint

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

CWE-416

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-38076",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "0db6f8d7820a4b788565dac8eed52bfc2c3216da",
              "lessThan": "3cc733e6d96c938d2b82be96858a0ab900eb6fdc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0db6f8d7820a4b788565dac8eed52bfc2c3216da",
              "lessThan": "12ca42c237756182aad8ab04654c952765cb9061",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "include/linux/alloc_tag.h",
            "include/linux/codetag.h",
            "include/linux/percpu.h",
            "lib/alloc_tag.c",
            "lib/codetag.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.13",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.14.9",
              "versionType": "semver",
              "lessThanOrEqual": "6.14.*"
            },
            {
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "include/linux/alloc_tag.h",
            "include/linux/codetag.h",
            "include/linux/percpu.h",
            "lib/alloc_tag.c",
            "lib/codetag.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-06-18T10:15:41.110",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/12ca42c237756182aad8ab04654c952765cb9061",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3cc733e6d96c938d2b82be96858a0ab900eb6fdc",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nalloc_tag: allocate percpu counters for module tags dynamically\n\nWhen a module gets unloaded it checks whether any of its tags are still in\nuse and if so, we keep the memory containing module's allocation tags\nalive until all tags are unused.  However percpu counters referenced by\nthe tags are freed by free_module().  This will lead to UAF if the memory\nallocated by a module is accessed after module was unloaded.\n\nTo fix this we allocate percpu counters for module allocation tags\ndynamically and we keep it alive for tags which are still in use after\nmodule unloading.  This also removes the requirement of a larger\nPERCPU_MODULE_RESERVE when memory allocation profiling is enabled because\npercpu memory for counters does not need to be reserved anymore."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: alloc_tag: asignar contadores por CPU para etiquetas de módulo dinámicamente Cuando se descarga un módulo, este verifica si alguna de sus etiquetas aún está en uso y, de ser así, mantenemos activa la memoria que contiene las etiquetas de asignación del módulo hasta que todas las etiquetas estén sin usar. Sin embargo, los contadores por CPU referenciados por las etiquetas son liberados por free_module(). Esto conducirá a UAF si se accede a la memoria asignada por un módulo después de que el módulo se haya descargado. Para corregir esto, asignamos contadores por CPU para etiquetas de asignación de módulo dinámicamente y los mantenemos activos para las etiquetas que aún están en uso después de la descarga del módulo. Esto también elimina el requisito de un PERCPU_MODULE_RESERVE más grande cuando el perfil de asignación de memoria está habilitado porque la memoria por CPU para los contadores ya no necesita reservarse."
    }
  ],
  "lastModified": "2026-06-17T09:16:00.360",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9B72DD1-715C-4101-A720-1C8D70044C06",
              "versionEndExcluding": "6.14.9",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D240580-3048-49B2-9E27-F115A9DF8224"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90320558-E553-4EF5-8A0B-0F5D20113BD2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C300BA32-5854-4B59-A00A-18A402F291D0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}