PT-2025-27987 · Linux+6 · Linux Kernel+6
CVE-2025-38212
·
Published
2025-04-24
·
Updated
2026-05-26
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.1.147-1 (Debian bookworm), 6.6.101 (upstream), and SLE 15 SP4, SLE 15 SP5, SLE 15 SP6, and openSUSE Leap 15.4, 15.5.
Description
The Linux kernel contains a vulnerability related to a use-after-free condition in the
ipc subsystem, specifically concerning the protection of IPCS lookups using RCU (Read-Copy-Update). The idr for each() function is protected by rwsem, but this is insufficient. Without proper RCU read-critical region protection, the radix tree node structure can be freed prematurely, leading to a potential use-after-free scenario when accessing the memory in subsequent iterations. This vulnerability could allow for local privilege escalation and potentially denial of service.Recommendations
- Upgrade the Linux kernel to version 6.1.147-1 or later on Debian bookworm distributions.
- Upgrade to the latest available kernel version for SLE 15 SP4, SLE 15 SP5, SLE 15 SP6, and openSUSE Leap 15.4, 15.5.
- Apply the available Live Patches 22, 29, and 40 for the respective SUSE distributions.
- Upgrade to kernel version 6.6.101 or later.
Exploit
Fix
LPE
DoS
Out of bounds Read
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu