CVE-2025-38554Use After Free in Linux

CWE-416Use After Free5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 97.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedAug 19

Description

In the Linux kernel, the following vulnerability has been resolved: mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped By inducing delays in the right places, Jann Horn created a reproducer for a hard to hit UAF issue that became possible after VMAs were allowed to be recycled by adding SLAB_TYPESAFE_BY_RCU to their cache. Race description is borrowed from Jann's discovery report: lock_vma_under_rcu() looks up a VMA locklessly with mas_walk() under rcu_read_lock(). At that p

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

NVDlinux/linux_kernel6.156.15.10+1
CVEListV5linux/linux3104138517fc66aad21f4a2487bb572e9fc2e3ec6e88fe54721dee17d3496bc998f0c7d243896348+3
debiandebian/linux

Patches

🔴Vulnerability Details

2
GHSA
GHSA-wf4q-q8qj-834v: In the Linux kernel, the following vulnerability has been resolved: mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped By inducing2025-08-19
OSV
CVE-2025-38554: In the Linux kernel, the following vulnerability has been resolved: mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped By inducing d2025-08-19

📋Vendor Advisories

2
Red Hat
kernel: mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped2025-08-19
Debian
CVE-2025-38554: linux - In the Linux kernel, the following vulnerability has been resolved: mm: fix a U...2025
CVE-2025-38554 — Use After Free in Linux | cvebase