CVE-2025-38273
Estado: ModificadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
net: tipc: fix refcount warning in tipc_aead_encrypt
syzbot reported a refcount warning [1] caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup.
The recently added get_net() call in commit e279024617134 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to hold a reference to the network namespace. However, if the namespace is already being destroyed, its refcount might be zero, leading to the use-after-free warning.
Leer descripción completaMostrar menos
Replace get_net() with maybe_get_net(), which safely checks if the refcount is non-zero before incrementing it. If the namespace is being destroyed, return -ENODEV early, after releasing the bearer reference.
[1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.19%
- Percentil entre todas las CVEs puntuadas: 8
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- NVD-CWE-Other
Referencias
- https://git.kernel.org/stable/c/307391e8fe70401a6d39ecc9978e13c2c0cdf81f
- https://git.kernel.org/stable/c/445d59025d76d0638b03110f8791d5b89ed5162d
- https://git.kernel.org/stable/c/9ff60e0d9974dccf24e89bcd3ee7933e538d929f
- https://git.kernel.org/stable/c/acab7ca5ff19889b80a8ee7dec220ee1a96dede9
- https://git.kernel.org/stable/c/c762fc79d710d676b793f9d98b1414efe6eb51e6
- https://git.kernel.org/stable/c/e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029
- https://git.kernel.org/stable/c/f29ccaa07cf3d35990f4d25028cc55470d29372b
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-38273",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "d42ed4de6aba232d946d20653a70f79158a6535b",
"lessThan": "445d59025d76d0638b03110f8791d5b89ed5162d",
"versionType": "git"
},
{
"status": "affected",
"version": "f5c2c4eaaa5a8e7e0685ec031d480e588e263e59",
"lessThan": "e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029",
"versionType": "git"
},
{
"status": "affected",
"version": "b8fcae6d2e93c54cacb8f579a77d827c1c643eb5",
"lessThan": "307391e8fe70401a6d39ecc9978e13c2c0cdf81f",
"versionType": "git"
},
{
"status": "affected",
"version": "b19fc1d0be3c3397e5968fe2627f22e7f84673b1",
"lessThan": "acab7ca5ff19889b80a8ee7dec220ee1a96dede9",
"versionType": "git"
},
{
"status": "affected",
"version": "689a205cd968a1572ab561b0c4c2d50a10e9d3b0",
"lessThan": "c762fc79d710d676b793f9d98b1414efe6eb51e6",
"versionType": "git"
},
{
"status": "affected",
"version": "e279024617134c94fd3e37470156534d5f2b3472",
"lessThan": "9ff60e0d9974dccf24e89bcd3ee7933e538d929f",
"versionType": "git"
},
{
"status": "affected",
"version": "e279024617134c94fd3e37470156534d5f2b3472",
"lessThan": "f29ccaa07cf3d35990f4d25028cc55470d29372b",
"versionType": "git"
},
{
"status": "affected",
"version": "4a0fddc2c0d5c28aec8c262ad4603be0bef1938c",
"versionType": "git"
},
{
"status": "affected",
"version": "5.10.238",
"lessThan": "5.10.239",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.185",
"lessThan": "5.15.186",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.141",
"lessThan": "6.1.142",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.93",
"lessThan": "6.6.94",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.31",
"lessThan": "6.12.34",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.14.9",
"lessThan": "6.15",
"versionType": "semver"
}
],
"programFiles": [
"net/tipc/crypto.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.239",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.186",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.142",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.94",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.34",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.15.3",
"versionType": "semver",
"lessThanOrEqual": "6.15.*"
},
{
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/tipc/crypto.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-07-10T08:15:25.530",
"references": [
{
"url": "https://git.kernel.org/stable/c/307391e8fe70401a6d39ecc9978e13c2c0cdf81f",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/445d59025d76d0638b03110f8791d5b89ed5162d",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9ff60e0d9974dccf24e89bcd3ee7933e538d929f",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/acab7ca5ff19889b80a8ee7dec220ee1a96dede9",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c762fc79d710d676b793f9d98b1414efe6eb51e6",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f29ccaa07cf3d35990f4d25028cc55470d29372b",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tipc: fix refcount warning in tipc_aead_encrypt\n\nsyzbot reported a refcount warning [1] caused by calling get_net() on\na network namespace that is being destroyed (refcount=0). This happens\nwhen a TIPC discovery timer fires during network namespace cleanup.\n\nThe recently added get_net() call in commit e279024617134 (\"net/tipc:\nfix slab-use-after-free Read in tipc_aead_encrypt_done\") attempts to\nhold a reference to the network namespace. However, if the namespace\nis already being destroyed, its refcount might be zero, leading to the\nuse-after-free warning.\n\nReplace get_net() with maybe_get_net(), which safely checks if the\nrefcount is non-zero before incrementing it. If the namespace is being\ndestroyed, return -ENODEV early, after releasing the bearer reference.\n\n[1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: tipc: corrección de la advertencia de recuento de referencias en tipc_aead_encrypt. syzbot reportó una advertencia de recuento de referencias [1] causada por la llamada a get_net() en un espacio de nombres de red que se está destruyendo (recuento de referencias = 0). Esto ocurre cuando se activa un temporizador de descubrimiento de TIPC durante la limpieza del espacio de nombres de red. La llamada a get_net(), recientemente añadida en el commit e279024617134 (\"net/tipc: corrección de la lectura de slab-use-after-free en tipc_aead_encrypt_done\"), intenta contener una referencia al espacio de nombres de red. Sin embargo, si el espacio de nombres ya se está destruyendo, su recuento de referencias podría ser cero, lo que genera la advertencia de use-after-free. Reemplace get_net() por perhaps_get_net(), que comprueba de forma segura si el recuento de referencias es distinto de cero antes de incrementarlo. Si el espacio de nombres se está destruyendo, devuelva -ENODEV antes de tiempo, después de liberar la referencia del portador. [1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2"
}
],
"lastModified": "2026-07-30T06:23:05.490",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D24F0A12-3789-4D0F-9D46-EC46B5EF9615",
"versionEndExcluding": "6.12.34",
"versionStartIncluding": "6.12.31"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2932EEA2-2EDB-4FE6-9BF4-C1F90FF22950",
"versionEndExcluding": "6.15",
"versionStartIncluding": "6.14.9"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "94EFC2F0-D796-44B3-BB7E-D7800275E9AD",
"versionEndExcluding": "6.15.3",
"versionStartIncluding": "6.15.1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.10.238:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3F13BEF6-CA61-4A23-9CED-61663F79A4A6"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.15.185:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E141EB19-F649-4D87-A508-F9B8A551E196"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.1.141:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EE80C371-EA85-49FF-8CEB-D5CAB2E8358E"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.6.93:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6C2C1D69-D7DD-494F-BFFC-05CEC1F3675C"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A1ECC65A-EE37-4479-8E99-4BB68A22A31F"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}