CVE-2025-38464: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38464 Overview

CVE-2025-38464 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Transparent Inter-Process Communication (TIPC) subsystem. The flaw exists in tipc_conn_close() within net/tipc/topsrv.c and was reported by syzbot as a null-pointer dereference triggered during network namespace dismantling. During teardown, tipc_topsrv_stop() iterates the connection IDR and invokes tipc_conn_close() after releasing the IDR lock, creating a window where a concurrent tipc_conn_recv_work() can release the connection's last reference. The affected object is freed before the second caller dereferences it, producing a KASAN use-after-free read.

Critical Impact
Local attackers with the ability to trigger TIPC network namespace teardown can achieve kernel memory corruption, potentially leading to privilege escalation, denial of service, or arbitrary code execution in kernel context.

Affected Products

Linux kernel (multiple stable branches up to 6.16-rc5)
Debian Linux 11.0
Distributions shipping kernels with the TIPC topology server enabled

Discovery Timeline

2025-07-25 - CVE-2025-38464 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38464

Vulnerability Analysis

The vulnerability is a use-after-free in the TIPC topology server's connection cleanup path. When a network namespace is destroyed, tipc_topsrv_stop() walks tipc_net(net)->topsrv->conn_idr and calls tipc_conn_close() on every registered tipc_conn. The function releases the IDR lock before invoking the close routine. This creates a race window against the deferred workqueue handler tipc_conn_recv_work(), which can independently release the final kref on the same connection via conn_put() and tipc_conn_kref_release().

Once the last reference drops, the 512-byte slab object backing the tipc_conn is returned to the kmalloc-512 cache. The teardown path then dereferences the freed pointer inside tipc_conn_close(), producing the KASAN report at offset 8 of the freed region. Because the freed memory can be reallocated and controlled by another allocator user, this is a classic exploitable use-after-free primitive in kernel address space.

Root Cause

The root cause is missing reference counting across the IDR-walk boundary. The fix is to take an additional reference on the tipc_conn while the IDR lock is held, then release that reference after tipc_conn_close() returns. This guarantees the object remains alive throughout the close call regardless of concurrent work-queue activity.

Attack Vector

Exploitation requires local access with the capability to create and destroy network namespaces containing TIPC sockets. An unprivileged user in a user namespace with CAP_NET_ADMIN in that namespace can typically create the required TIPC topology-server connections. Racing namespace teardown against pending tipc_conn_recv_work() items triggers the free. Reliable exploitation depends on heap grooming inside kmalloc-512 and precise timing of the workqueue.

Refer to the upstream kernel commits linked in the Linux kernel git repository for the exact patch that adds the missing kref acquisition.

Detection Methods for CVE-2025-38464

Indicators of Compromise

KASAN reports in dmesg referencing use-after-free in tipc_conn_close at net/tipc/topsrv.c:165
Unexpected kernel panics or oops messages originating from cleanup_net workqueue involving tipc_topsrv_exit_net
Repeated creation and destruction of network namespaces by non-root processes that load the tipc module

Detection Strategies

Enable kernel address sanitizer (KASAN) in test or canary hosts to catch use-after-free conditions during TIPC namespace teardown
Audit for processes invoking unshare(CLONE_NEWNET) or setns() in tight loops while opening TIPC sockets (AF_TIPC)
Monitor loaded kernel modules for the presence of tipc on systems that do not require it, and alert on unexpected module loads

Monitoring Recommendations

Ship kernel ring buffer output to a centralized logging pipeline and alert on KASAN, BUG:, and general protection fault strings involving TIPC symbols
Track syscall telemetry for namespace-manipulation calls originating from unprivileged UIDs
Correlate unexpected kworker/* crashes with recent TIPC socket activity to identify race attempts

How to Mitigate CVE-2025-38464

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the vendor advisories to every stable branch in use
On Debian systems, install the kernel updates from Debian LTS Announcement #07 and Debian LTS Announcement #08
Where patching is delayed, blacklist the tipc module on hosts that do not require it

Patch Information

The fix is distributed across multiple stable branches. Reference commits include 03dcdd2558e1, 15a6f4971e2f, 1dbf7cd2454a, 3b89e17b2fd6, 50aa2d121bc2, 667eeab4999e, be4b8392da79, and dab8ded2e5ff. Each commit adds a kref acquisition around the IDR walk in tipc_topsrv_stop() so the connection remains valid across the tipc_conn_close() call. See the upstream commit for the canonical fix.

Workarounds

Blacklist the TIPC kernel module by adding blacklist tipc to /etc/modprobe.d/blacklist-tipc.conf and rebuilding the initramfs
Restrict unprivileged user namespace creation by setting kernel.unprivileged_userns_clone=0 where policy allows, reducing the ability to trigger the race path
Limit CAP_NET_ADMIN in containers and unprivileged workloads that do not require TIPC functionality

bash

# Configuration example: disable the TIPC module
echo 'blacklist tipc' | sudo tee /etc/modprobe.d/blacklist-tipc.conf
echo 'install tipc /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-tipc.conf
sudo update-initramfs -u

# Restrict unprivileged namespace creation
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-userns.conf
sudo sysctl --system