PT-2025-33579 · Linux+1 · Linux Kernel+1

Published 2025-07-15 · Updated 2025-08-16 · CVE-2025-38536

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The Linux kernel contains a use-after-free flaw within the airoha npu get() function. The vulnerability occurs because the np->name field is accessed after the associated node has been released by of node put(np). This can happen if pdev is NULL, leading to a use-after-free condition. The issue has been addressed by moving the call to of node put(np) after an error check, ensuring the node is released only after both success and error scenarios are handled.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2026-03112

CVE-2025-38536

Affected Products

Astra Linux

Linux Kernel

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38536.json · Exploit
• https://bdu.fstec.ru/vul/2026-03112 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38536 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-38536 · Security Note
• https://ubuntu.com/security/CVE-2025-38536 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-38536 · Vendor Advisory
• https://git.kernel.org/stable/c/3cd582e7d0787506990ef0180405eb6224fa90a6 · Patch
• https://git.kernel.org/stable/c/df6bf96b41e547e350667bc4c143be53646d070d · Patch
• https://osv.dev/vulnerability/CVE-2025-38536 · Vendor Advisory
• https://lore.kernel.org/linux-cve-announce/2025081656-CVE-2025-38536-c669@gregkh · Note
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.8 · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://git.kernel.org/linus/3cd582e7d0787506990ef0180405eb6224fa90a6 · Note
• https://twitter.com/CVEnew/status/1956766322785652930 · Twitter Post