cbcvebase.
CVE-2025-38129
published 2025-07-03

CVE-2025-38129: In the Linux kernel, the following vulnerability has been resolved: page_pool: Fix use-after-free in page_pool_recycle_in_ring syzbot reported a uaf in…

PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.17%
6.1th percentile
In the Linux kernel, the following vulnerability has been resolved: page_pool: Fix use-after-free in page_pool_recycle_in_ring syzbot reported a uaf in page_pool_recycle_in_ring: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 Read of size 8 at addr ffff8880286045a0 by task syz.0.284/6943 CPU: 0 UID: 0 PID: 6943 Comm: syz.0.284 Not tainted 6.13.0-rc3-syzkaller-gdfa94ce54f41 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:165 [inline] _raw_spin_unlock_bh+0x1b/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_produce_bh include/linux/ptr_ring.h:164 [inline] page_pool_recycle_in_ring net/core/page_pool.c:707 [inline] page_pool_put_unrefed_netmem+0x748/0xb00 net/core/page_pool.c:826 page_pool_put_netmem include/net/page_pool/helpers.h:323 [inline] page_pool_put_full_netmem include/net/page_pool/helpers.h:353 [inline] napi_pp_put_page+0x149/0x2b0 net/core/skbuff.c:1036 skb_pp_recycle net/core/skbuff.c:1047 [inline] skb_free_head net/core/skbuff.c:1094 [inline] skb_release_data+0x6c4/0x8a0 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x1c9/0x380 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1263 [inline] __skb_queue_purge_reason include/linux/skbuff.h:3343 [inline] root cause is: page_pool_recycle_in_ring ptr_ring_produce spin_lock(&r->producer_lock); WRITE_ONCE(r->queue[r->producer++], ptr) //recycle last page to pool page_pool_release page_pool_scrub page_pool_empty_ring p

Affected

29 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
debianlinux-6.1< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
linuxlinux
linuxlinux>= ff7d6b27f894f1469dc51ccb828b7363ccd9799f < c2c906142293931e33ef4be79ebc36c25c4e21ddc2c906142293931e33ef4be79ebc36c25c4e21dd
linuxlinux>= ff7d6b27f894f1469dc51ccb828b7363ccd9799f < d69f28ef7cdafdcf37ee310f38b1399e7d05f9a8d69f28ef7cdafdcf37ee310f38b1399e7d05f9a8
linuxlinux>= ff7d6b27f894f1469dc51ccb828b7363ccd9799f < 1a8c0b61d4cb55c5440583ec9e7f86a730369e321a8c0b61d4cb55c5440583ec9e7f86a730369e32
linuxlinux>= ff7d6b27f894f1469dc51ccb828b7363ccd9799f < 4914c0a166540e534a0c1d43affd329d95fb56fd4914c0a166540e534a0c1d43affd329d95fb56fd
linuxlinux>= ff7d6b27f894f1469dc51ccb828b7363ccd9799f < e869a85acc2e60dc554579b910826a4919d8cd98e869a85acc2e60dc554579b910826a4919d8cd98
linuxlinux>= ff7d6b27f894f1469dc51ccb828b7363ccd9799f < 4ab8c0f8905c9c4d05e7f437e65a9a365573ff024ab8c0f8905c9c4d05e7f437e65a9a365573ff02
linuxlinux>= ff7d6b27f894f1469dc51ccb828b7363ccd9799f < 271683bb2cf32e5126c592b5d5e6a756fa374fd9271683bb2cf32e5126c592b5d5e6a756fa374fd9
linuxlinux_kernel>= 0 < 6.1.162-16.1.162-1
linuxlinux_kernel>= 0 < 6.12.35-16.12.35-1
linuxlinux_kernel>= 0 < 6.12.35-16.12.35-1
linuxlinux_kernel>= 0 < 5.15.0-173.1835.15.0-173.183
linuxlinux_kernel>= 0 < 6.8.0-100.1006.8.0-100.100
linuxlinux_kernel>= 4.18 < 6.12.346.12.34
linuxlinux_kernel>= 6.13 < 6.15.36.15.3
msrcazl3_kernel_6.6.92.2-2_on_azure_linux_3.0
msrccbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0
ubuntulinux-aws
ubuntulinux-aws-6.8
ubuntulinux-azure-5.15
ubuntulinux-gkeop
ubuntulinux-nvidia
ubuntulinux-nvidia-6.8

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.