PT-2025-33753 · Linux+2 · Linux Kernel+2

Jann Horn

·

Published

2025-07-28

·

Updated

2026-01-26

·

CVE-2025-38554

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)
Description: The Linux kernel contains a use-after-free (UAF) issue within the memory management subsystem. This flaw occurs when a virtual memory area's (VMA) mm pointer is freed after the VMA's reference count (vm refcnt) has been dropped. A race condition can occur where a VMA is recycled and subsequently accessed with a stale mm pointer, leading to a UAF. The issue arises from a mismatch in the timing of reference count decrements and VMA recycling, potentially triggered by operations like mmap and munmap. Specifically, lock vma under rcu() can detect a mismatched vm mm pointer after the VMA has been recycled, leading to a call to vma refcount put(), which then incorrectly attempts to wake up a waiting process using the freed memory.
Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

NULL Pointer Dereference

Weakness Enumeration

Related Identifiers

BDU:2025-14103
CVE-2025-38554
OPENSUSE-SU-2025:20081-1
SUSE-SU-2025:21074-1
SUSE-SU-2025:21139-1
SUSE-SU-2025:21179-1
SUSE-SU-2026:20149-1
SUSE-SU-2026:20164-1
SUSE-SU-2026:20169-1

Affected Products

Astra Linux
Linux Kernel
Suse