CVE-2025-38129: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38129 Overview

CVE-2025-38129 is a use-after-free vulnerability in the Linux kernel's page_pool subsystem, specifically in the page_pool_recycle_in_ring function within net/core/page_pool.c. The flaw was discovered by syzbot fuzzing, which triggered a KASAN slab-use-after-free report in lock_release during network packet recycling. An attacker with local access can trigger the race between page recycling and page pool destruction to corrupt kernel memory. The vulnerability is tracked under CWE-416.

Critical Impact
Local attackers can exploit the race condition to trigger a use-after-free in the kernel's networking page pool, leading to memory corruption, kernel crashes, or potential local privilege escalation.

Affected Products

Linux Kernel (multiple stable branches prior to the patched commits)
Distributions shipping unpatched kernels with CONFIG_PAGE_POOL enabled
Systems using drivers that rely on the network page_pool API for packet buffer recycling

Discovery Timeline

2025-07-03 - CVE-2025-38129 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38129

Vulnerability Analysis

The defect lives in the Linux networking page_pool allocator, which recycles DMA-mapped pages for high-throughput NIC drivers. When page_pool_recycle_in_ring returns a page to the ring buffer via ptr_ring_produce_bh, it acquires the producer spinlock, writes the page pointer, and then releases the lock. Between the write and the spin_unlock_bh call, a concurrent path can consume the last page, invoke page_pool_release, drain the ring through page_pool_empty_ring, and finally call __page_pool_destroy which frees the pool structure with free_percpu(pool->recycle_stats) and free(pool).

Once the pool is freed, the still-executing spin_unlock_bh on &r->producer_lock dereferences freed memory, and the subsequent recycle_stat_inc(pool, ring) reads dangling state. KASAN reports the 8-byte out-of-lifetime read inside lock_release+0x151/0xa30 in kernel/locking/lockdep.c:5862. The fix adds a producer-lock barrier in page_pool_release, ensuring the pool cannot be freed until all in-flight recyclers have exited the critical section.

Root Cause

The root cause is a missing synchronization barrier between page recycling and page pool teardown. The recycle path releases its spinlock after the ring produce operation, but the destroy path treats consumption of the last page as sufficient to free the pool. This violates the lifetime assumption that pool->ring.producer_lock remains valid for the duration of spin_unlock_bh, producing a classic use-after-free.

Attack Vector

Exploitation requires local access with the ability to drive network traffic or otherwise cause page_pool allocations and releases through a driver that uses the API, such as high-performance NIC drivers or XDP-enabled network paths. An attacker races page recycle operations against pool destruction to trigger the freed-memory access. Successful exploitation corrupts kernel memory and can be shaped into privilege escalation. The syzbot reproducer demonstrates the race is reachable from unprivileged workloads that touch skb recycling paths, though timing is sensitive.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-38129

Indicators of Compromise

KASAN kernel logs reporting slab-use-after-free in lock_release with call traces through page_pool_recycle_in_ring and page_pool_put_unrefed_netmem
Unexplained kernel oops or panics originating in net/core/page_pool.c or net/core/skbuff.c during heavy network I/O
Lockdep splats referencing producer_lock on freed page_pool objects

Detection Strategies

Enable CONFIG_KASAN and CONFIG_DEBUG_LOCKDEP on non-production kernels to surface the freed-memory access at runtime
Compare the running kernel version against the fixed commits 1a8c0b61, 271683bb, 4914c0a1, 4ab8c0f8, c2c90614, d69f28ef, and e869a85a from git.kernel.org
Audit installed drivers for use of the page_pool API and prioritize patching hosts that terminate high-volume network traffic

Monitoring Recommendations

Forward dmesg and kern.log to a central log store and alert on KASAN, lockdep, or oops events referencing page_pool or ptr_ring
Track kernel crash telemetry across the fleet to catch reproducible faults in the networking stack
Monitor for abnormal reboot cycles or watchdog resets on network-heavy hosts, which may indicate exploitation attempts

How to Mitigate CVE-2025-38129

Immediate Actions Required

Apply the upstream stable kernel updates that include the page_pool_release producer-lock barrier fix and rebuild any custom kernels
Prioritize patching hosts exposed to untrusted local users, container workloads, and multi-tenant environments
Restrict local access on high-value systems until patched kernels are deployed and verified

Patch Information

The fix adds a producer-lock barrier to page_pool_release so the pool cannot be freed until in-flight recyclers finish their critical section, and it defines recycle_stat_inc() as an empty statement when CONFIG_PAGE_POOL_STATS is disabled to avoid -Wempty-body warnings. Patched commits are published on kernel.org, including commit 271683bb, commit 4ab8c0f8, and commit e869a85a. Additional backports are tracked at commit 1a8c0b61, commit 4914c0a1, commit c2c90614, and commit d69f28ef.

Workarounds

No official workaround exists; the vulnerability requires the kernel-level synchronization fix to eliminate the race
Reduce local attack surface by limiting untrusted code execution, restricting container capabilities, and disabling unnecessary network drivers that use page_pool
Where feasible, run mainline or vendor kernels that already include the backported fix rather than deferring updates

bash

# Verify kernel version and confirm the fix is present
uname -r
grep -E 'page_pool_release|producer_lock' /usr/src/linux/net/core/page_pool.c