PT-2025-27987 · Linux+6 · Linux Kernel+6
CVE-2025-38212
·
Publicado
2025-04-24
·
Atualizado
2026-05-26
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.1.147-1 (Debian bookworm), 6.6.101 (upstream), and SLE 15 SP4, SLE 15 SP5, SLE 15 SP6, and openSUSE Leap 15.4, 15.5.
Description
The Linux kernel contains a vulnerability related to a use-after-free condition in the
ipc subsystem, specifically concerning the protection of IPCS lookups using RCU (Read-Copy-Update). The idr for each() function is protected by rwsem, but this is insufficient. Without proper RCU read-critical region protection, the radix tree node structure can be freed prematurely, leading to a potential use-after-free scenario when accessing the memory in subsequent iterations. This vulnerability could allow for local privilege escalation and potentially denial of service.Recommendations
- Upgrade the Linux kernel to version 6.1.147-1 or later on Debian bookworm distributions.
- Upgrade to the latest available kernel version for SLE 15 SP4, SLE 15 SP5, SLE 15 SP6, and openSUSE Leap 15.4, 15.5.
- Apply the available Live Patches 22, 29, and 40 for the respective SUSE distributions.
- Upgrade to kernel version 6.6.101 or later.
Exploit
Correção
LPE
DoS
Out of bounds Read
Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu