CVE-2025-38052: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38052 Overview

CVE-2025-38052 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Transparent Inter-Process Communication (TIPC) subsystem. The flaw resides in the tipc_aead_encrypt_done function in net/tipc/crypto.c. Syzbot detected a slab-use-after-free read triggered when a network namespace is deleted while asynchronous cryptographic encryption is still pending in the cryptd workqueue. A local attacker with the ability to create network namespaces and manipulate TIPC bearers can free the tipc_crypto transmit context, then have the deferred cryptd_queue_worker dereference the freed memory.

Critical Impact
Local exploitation can lead to kernel memory corruption, resulting in privilege escalation, denial of service, or arbitrary code execution in kernel context.

Affected Products

Linux kernel versions up to 6.15-rc7 (see NVD CPE list for exact ranges)
Debian Linux 11.0
Kernel builds with the TIPC subsystem (CONFIG_TIPC) enabled

Discovery Timeline

2025-06-18 - CVE-2025-38052 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38052

Vulnerability Analysis

The vulnerability occurs in TIPC's AEAD (Authenticated Encryption with Associated Data) transmission path. When TIPC encrypts an outgoing packet via tipc_aead_encrypt, it calls crypto_aead_encrypt, which routes through simd_aead_encrypt. If crypto_simd_usable() returns false, for example because the SIMD path was preempted, the request is enqueued to the cryptd workqueue and processed asynchronously by cryptd_queue_worker.

The TIPC crypto TX context is allocated in tipc_crypto_start during namespace initialization and freed in tipc_crypto_stop when the namespace exits. Because the asynchronous crypto request does not hold a reference to the network namespace, deleting the namespace can free the tipc_crypto structure while a pending cryptd work item still references it. When the worker completes and invokes tipc_aead_encrypt_done, it reads eight bytes from the freed slab object, producing a KASAN slab-use-after-free report at net/tipc/crypto.c:840.

Root Cause

The root cause is missing lifetime management between the tipc_crypto TX context and in-flight asynchronous cryptographic requests. The encryption path does not take a reference on the network namespace or the crypto object before dispatching work to cryptd, so namespace teardown can race ahead of the deferred worker.

Attack Vector

Exploitation is local and requires the ability to create user or network namespaces and configure TIPC bearers. A reproducer creates a namespace, adds a veth pair, enables a TIPC bearer, sets a master key, disables the bearer, and deletes the namespace. If simd_aead_encrypt is interrupted so that crypto_simd_usable() is false, the cryptd_queue_worker fires after tipc_crypto_stop has already freed the TX context, causing the use-after-free.

No public exploit is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The upstream fix holds a network namespace reference count before encryption to keep the tipc_crypto object alive until asynchronous work completes.

Detection Methods for CVE-2025-38052

Indicators of Compromise

KASAN reports containing slab-use-after-free in tipc_aead_encrypt_done in kernel logs (dmesg, journalctl -k).
Unexpected kernel oops, panics, or memory corruption warnings originating from net/tipc/crypto.c.
Unprivileged processes performing repeated unshare calls combined with TIPC bearer configuration changes.

Detection Strategies

Enable KASAN on test kernels to surface use-after-free reads in the TIPC AEAD completion path.
Audit for unexpected loading of the tipc kernel module using lsmod and module load auditing rules.
Monitor auditd for unshare() syscalls that combine CLONE_NEWNET with subsequent TIPC configuration commands from non-root users.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on KASAN, BUG:, or general protection fault strings referencing tipc_.
Track process execution of tipc, ip netns, and ip link binaries by non-administrative users.
Baseline TIPC module usage across the fleet; investigate any host where tipc loads unexpectedly.

How to Mitigate CVE-2025-38052

Immediate Actions Required

Apply the upstream stable kernel patches referenced by commits 4a0fddc, 689a205, b19fc1d, b8fcae6, d42ed4d, e279024, and f5c2c4e from kernel.org.
Install the Debian security updates announced in the Debian LTS Announcement 2025-10-07 and Debian LTS Announcement 2025-10-08.
Restrict the ability of unprivileged users to create user and network namespaces on hosts that do not require it.

Patch Information

The fix acquires a reference on the network namespace before dispatching the asynchronous AEAD encryption, ensuring the tipc_crypto TX context is not freed while cryptd_queue_worker is still in flight. The patch is available through the stable trees referenced in the kernel.org commit list. Distribution kernels should be updated to the versions shipped in the vendor advisories.

Workarounds

Blacklist the tipc kernel module on systems that do not use TIPC by adding blacklist tipc to /etc/modprobe.d/ and rebuilding the initramfs.
Set kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) to prevent unprivileged network namespace creation.
Restrict CAP_NET_ADMIN and namespace creation privileges on multi-tenant hosts.

bash

# Configuration example
# Disable the TIPC module
echo 'blacklist tipc' | sudo tee /etc/modprobe.d/disable-tipc.conf
sudo rmmod tipc 2>/dev/null || true

# Restrict unprivileged namespace creation (Debian/Ubuntu)
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-userns.conf
sudo sysctl --system