PT-2025-34427 · Linux+4 · Linux Kernel+4

Published

2025-01-01

·

Updated

2026-04-20

·

CVE-2025-38666

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.15.2
Description: A use-after-free vulnerability exists in the AARP proxy probe routine (aarp proxy probe network) within the Linux kernel. The vulnerability occurs when the routine releases the aarp lock, sleeps, and then re-acquires the lock. During this window, a separate timer thread ( aarp expire timer) can free the same memory entry, leading to a use-after-free condition. The vulnerability is triggered during the execution of aarp proxy probe network and can be observed through kernel crashes indicated by KASAN reports.
Recommendations: Update to Linux kernel version 6.15.2 or later to address this vulnerability.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

AZL-66665
AZL-73641
BDU:2025-15186
CVE-2025-38666
DLA-4327-1
DLA-4328-1
ECHO-A8F8-174D-7905
USN-7879-1
USN-7879-2
USN-7879-3
USN-7879-4
USN-7880-1
USN-7907-1
USN-7907-2
USN-7907-3
USN-7907-4
USN-7907-5
USN-7909-1
USN-7909-2
USN-7909-3
USN-7909-4
USN-7909-5
USN-7910-1
USN-7910-2
USN-7922-1
USN-7922-2
USN-7922-3
USN-7922-4
USN-7922-5
USN-7930-1
USN-7930-2
USN-7931-1
USN-7931-2
USN-7931-3
USN-7931-4
USN-7931-5
USN-7933-1
USN-7934-1
USN-7935-1
USN-7937-1
USN-7938-1
USN-7939-1
USN-7939-2
USN-7940-1
USN-7940-2

Affected Products

Debian
Linuxmint
Linux Kernel
Red Os
Ubuntu