CVE-2025-38154 Overview
CVE-2025-38154 is a use-after-free vulnerability [CWE-416] in the Linux kernel's bpf/sockmap subsystem. The flaw exists in the backlog worker path where sk->sk_socket is neither locked nor reference-counted during skb_send_sock(). A race between sk_psock_backlog() and sock_map_close() allows the socket to be released while the backlog thread dereferences sock->ops->sendmsg, leading to a kernel panic or exploitable memory corruption. All socket types backed by sockmap, including TCP, UDP, Unix, and vsock, are affected.
Critical Impact
A local attacker with the ability to create BPF sockmap entries can trigger a kernel use-after-free, resulting in denial of service or potential local privilege escalation on affected Linux systems.
Affected Products
- Linux kernel 6.10-rc2 through 6.10-rc7 and other stable branches prior to the fix
- Debian GNU/Linux 11 (Bullseye) shipping affected kernel versions
- Distributions consuming upstream stable kernels without the referenced backport commits
Discovery Timeline
- 2025-07-03 - CVE-2025-38154 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-38154
Vulnerability Analysis
The vulnerability resides in the sockmap backlog processing path. When sk_psock_backlog() invokes skb_send_sock(), the code proceeds through sendmsg_unlocked() and sock_sendmsg() without holding a reference to sk->sk_socket. Concurrently, a close(fd) on another CPU can invoke sock_map_close(), which calls the socket's release operation, sets sk_socket->ops to NULL, and frees the socket structure.
The backlog thread then dereferences sock->ops->sendmsg on freed memory, producing the observed general protection fault in sock_sendmsg+0x21d/0x440. Because the deallocated socket memory may be reallocated and controlled by an attacker, the condition escalates beyond a simple crash into a potentially exploitable use-after-free.
Root Cause
The root cause is missing synchronization between the backlog worker and socket teardown. In sock_map_close(), sock_map_remove_links() drops the last psock reference before the code re-acquires it via sk_psock_get(). If the reference count is already zero, control jumps to no_psock, skipping cancel_delayed_work_sync(&psock->work). Any in-flight backlog work therefore continues executing against a socket that is being freed.
Attack Vector
Exploitation requires local access and the ability to attach sockets to a BPF sockmap, an operation available to processes with CAP_BPF or within permissive namespace configurations. An attacker races repeated close() calls against sockmap-driven send operations to trigger the use-after-free. The upstream fix increases the psock reference count on the backlog path so sock_map_close() waits for the worker to complete and cancels pending work before releasing the socket. See the upstream fix commit for the corrected synchronization logic.
Detection Methods for CVE-2025-38154
Indicators of Compromise
- Kernel oops or general protection fault traces containing sock_sendmsg+0x21d, __skb_send_sock, and sk_psock_backlog in the call stack
- Unexpected Workqueue: events sk_psock_backlog crash entries in dmesg or /var/log/kern.log
- Repeated kernel warnings referencing sock_map_close on systems running BPF sockmap workloads
Detection Strategies
- Inventory kernels against the fixed commits listed in the kernel.org stable advisories to identify unpatched hosts
- Audit BPF program loads and sockmap creation via bpftool prog show and bpftool map show to catalog exposure
- Enable kernel address sanitizer (KASAN) in test environments to surface use-after-free conditions in sk_psock_backlog
Monitoring Recommendations
- Forward kernel logs to a central SIEM and alert on panics referencing sk_psock_backlog or sock_sendmsg faults
- Monitor unprivileged process attempts to invoke bpf() syscalls with BPF_MAP_TYPE_SOCKMAP or BPF_MAP_TYPE_SOCKHASH
- Track sudden host reboots and workqueue-related crash dumps on systems exposing container workloads with BPF privileges
How to Mitigate CVE-2025-38154
Immediate Actions Required
- Apply the vendor kernel update containing the sockmap reference-counting fix on all affected Linux hosts
- Restrict CAP_BPF and CAP_SYS_ADMIN to trusted administrative accounts and workloads
- Review container runtime configurations to prevent unprivileged containers from loading BPF programs
Patch Information
The fix is available in upstream stable kernels via commits 15c0250d, 4c6fa65a, 4edb40b0, 7c0a16f6, 8259eb0e, and b19cbf0b. Debian users should install the update announced in the Debian LTS Announcement. Rebuild or repackage any custom kernels to include the corrected sk_psock_backlog synchronization.
Workarounds
- Disable BPF sockmap functionality in kernel builds where it is not required by unsetting CONFIG_BPF_STREAM_PARSER
- Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged BPF program loading
- Remove CAP_BPF from container security profiles (seccomp, AppArmor) until patches are deployed
# Configuration example
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/99-bpf-hardening.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
