CVE-2025-38079: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38079 Overview

CVE-2025-38079 is a double free vulnerability in the Linux kernel's algif_hash crypto socket implementation. The flaw resides in the hash_accept function within the AF_ALG cryptographic user-space interface. When accept(2) is called on an algif_hash socket with the MSG_MORE flag set and crypto_ahash_import fails, the child socket sk2 is freed inside the error handler. However, af_alg_release also frees the same socket, producing a slab-use-after-free condition. Local unprivileged users with access to the AF_ALG interface can trigger the flaw, potentially leading to kernel memory corruption and privilege escalation. The vulnerability is tracked as [CWE-415: Double Free].

Critical Impact
A local attacker can trigger a slab-use-after-free in kernel memory through the AF_ALG socket interface, enabling potential privilege escalation or system compromise.

Affected Products

Linux Kernel (multiple stable branches, including 6.15-rc1 through 6.15-rc7)
Debian Linux 11.0
Siemens products referenced in advisory SSA-082556

Discovery Timeline

2025-06-18 - CVE-2025-38079 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38079

Vulnerability Analysis

The vulnerability exists in the hash_accept function of the Linux kernel's algif_hash module, part of the AF_ALG subsystem that exposes kernel crypto algorithms to user space. When a process invokes accept(2) on an algif_hash socket, the kernel allocates a new child socket (sk2) and attempts to import the parent's hash state via crypto_ahash_import.

If crypto_ahash_import fails, the error path in hash_accept frees sk2 directly. The problem is that the socket has already been linked to the parent through af_alg_accept, so af_alg_release runs later during normal socket teardown and frees the same object again. This yields a classic double free tracked as [CWE-415].

A local user needs no privileges beyond the ability to open an AF_ALG socket. The resulting slab-use-after-free can be leveraged to corrupt adjacent kernel objects and escalate privileges on affected systems.

Root Cause

The root cause is duplicated cleanup ownership in the hash_accept error path. Both the failure branch inside hash_accept and the subsequent af_alg_release invocation call sock_put/free logic on sk2 without a guard flag or ownership transfer. The kernel slab allocator then serves the freed slot to another allocation while a stale pointer to it remains reachable.

Attack Vector

Exploitation requires local access to a system where the algif_hash module is loaded and reachable by an unprivileged user. The attacker creates an AF_ALG socket, binds it to a hash algorithm such as sha256, calls accept(2) with the MSG_MORE flag, and forces crypto_ahash_import to fail by supplying malformed state data. This triggers the double free of the child socket structure. Heap grooming and cross-cache techniques common to slab-use-after-free exploitation can then be used to gain kernel code execution.

No verified public exploit code is available for CVE-2025-38079. See the upstream fix commits listed in the Linux Kernel Commit 5bff312 and related patches for the exact code paths involved.

Detection Methods for CVE-2025-38079

Indicators of Compromise

Kernel log entries containing KASAN: slab-use-after-free referencing hash_accept or af_alg_release
Unexpected kernel oops or panic traces including algif_hash symbols
Unprivileged processes loading or accessing the algif_hash kernel module via AF_ALG sockets in unusual patterns

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test and staging systems to surface the double free at runtime
Audit process telemetry for socket(AF_ALG, SOCK_SEQPACKET, 0) calls followed by repeated accept(2) with MSG_MORE from non-crypto workloads
Monitor dmesg and /var/log/kern.log for BUG: KASAN or general protection fault entries tied to crypto subsystem call stacks

Monitoring Recommendations

Alert on modprobe or auto-load events for algif_hash on servers where user-space crypto is not required
Track kernel crashes and reboots through centralized logging and correlate with process ancestry
Baseline legitimate AF_ALG usage per host so anomalous invocation patterns from unprivileged users stand out

How to Mitigate CVE-2025-38079

Immediate Actions Required

Apply vendor-supplied kernel updates that include the upstream fix commits for algif_hashhash_accept
On Debian systems, install the packages referenced in the Debian LTS Announcement 00007 and Debian LTS Announcement 00008
Siemens operators should follow guidance in the Siemens Security Advisory SSA-082556
Reboot affected systems after patching to load the corrected kernel image

Patch Information

The fix is committed across multiple stable Linux kernel branches. See the upstream fix commits: Linux Kernel Commit 0346f4b, Linux Kernel Commit 134daab, Linux Kernel Commit 2f45a8d, Linux Kernel Commit 5bff312, Linux Kernel Commit b2df03e, Linux Kernel Commit bf7bba7, Linux Kernel Commit c3059d5, and Linux Kernel Commit f0f3d09. The fix removes the duplicate free in the hash_accept error path so socket teardown is handled solely by af_alg_release.

Workarounds

Blacklist the algif_hash module on systems that do not require user-space access to kernel hash algorithms
Restrict which users and containers can create AF_ALG sockets using seccomp or SELinux/AppArmor policies
Deny module autoloading with install algif_hash /bin/true in /etc/modprobe.d/ where the module is not needed

bash

# Blacklist algif_hash where user-space crypto is not required
echo "install algif_hash /bin/true" | sudo tee /etc/modprobe.d/blacklist-algif_hash.conf
sudo rmmod algif_hash 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep algif_hash