PT-2025-27715 · Linux+6 · Linux Kernel+6
Published
2025-05-27
·
Updated
2026-05-07
·
CVE-2025-38129
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.13.0-rc3-syzkaller-gdfa94ce54f41
Description:
A use-after-free issue has been identified in the Linux kernel, specifically in the
page pool recycle in ring function. This issue was reported by syzbot and is related to a slab-use-after-free error in lock release. The root cause of the problem is that the page pool can be freed while the last page in the ring is being recycled, leading to a use-after-free read. To fix this issue, a producer-lock barrier has been added to page pool release to prevent the page pool from being freed before all pages have been recycled.Recommendations:
For Linux kernel versions prior to 6.13.0-rc3-syzkaller-gdfa94ce54f41, consider applying the patch that adds a producer-lock barrier to
page pool release to prevent the page pool from being freed before all pages have been recycled. As a temporary workaround, consider disabling the page pool recycle in ring function until a patch is available. Restrict access to the vulnerable page pool module to minimize the risk of exploitation. Avoid using the ptr ring produce bh function in the affected API endpoint until the issue is resolved.Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu