CVE-2025-38476: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38476 Overview

CVE-2025-38476 is a use-after-free vulnerability in the Linux kernel's IPv6 Routing Protocol for Low-Power and Lossy Networks (RPL) source routing header implementation. The flaw resides in the rpl_do_srh_inline() function within net/ipv6/rpl_iptunnel.c. The function retrieves the IPv6 header pointer with ipv6_hdr(skb) and continues to access it after calling skb_cow_head(), which can free the underlying buffer. KASAN detects the invalid read during the lwt_dst_cache_ref_loop.sh selftest. The issue is tracked under [CWE-416] and affects multiple Linux kernel versions including the 6.16 release candidates.

Critical Impact
A local attacker with the ability to trigger RPL lightweight tunnel input processing can cause kernel memory corruption, leading to denial of service or potential local privilege escalation.

Affected Products

Linux Kernel (multiple stable branches, including 6.16-rc1 through 6.16-rc6)
Debian Linux 11.0 (patched via Debian LTS advisories)
Linux distributions shipping vulnerable stable kernels prior to the referenced fix commits

Discovery Timeline

2025-07-28 - CVE-2025-38476 published to the National Vulnerability Database
2025-10-07 - Debian LTS releases first advisory referencing the fix
2025-10-08 - Debian LTS publishes follow-up advisory
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38476

Vulnerability Analysis

The vulnerability is a classic use-after-free in kernel networking code. In rpl_do_srh_inline(), the code obtains a pointer to the inner IPv6 header from a socket buffer (skb) using ipv6_hdr(skb) and stores it as oldhdr. The function then calls skb_cow_head() to ensure sufficient headroom in the skb. When skb_cow_head() reallocates the head buffer, the memory referenced by oldhdr is released. Subsequent dereferences of oldhdr, including a memmove copying 40 bytes of the original header, operate on freed slab memory. KASAN flags this as a slab-use-after-free read of 40 bytes during RPL input processing.

The upstream fix promotes oldhdr from a pointer to a local struct, so the header contents are copied onto the stack before skb_cow_head() runs. This eliminates the dangling reference.

Root Cause

The root cause is improper lifetime management of a pointer into an skb buffer across a reallocation boundary. Kernel networking helpers such as skb_cow_head() may free and replace the linear data area. Any pointer obtained before the call becomes invalid afterward. The RPL source routing header insertion path did not observe this contract in net/ipv6/rpl_iptunnel.c at line 174.

Attack Vector

Exploitation requires the RPL lightweight tunnel (lwtunnel) to be configured on the target system and traffic to traverse the RPL input path. A local user who can send IPv6 packets through such a route triggers rpl_input(), which invokes the vulnerable inline SRH handler. The resulting freed-memory read can corrupt kernel state, crash the host, or, with additional heap grooming, allow attacker-controlled data to be interpreted as an IPv6 header. Network-based exploitation is not part of the reference scenario; the attack surface is local given the required routing configuration.

No public proof-of-concept exploit is available. The reproducer in the upstream report is the in-tree selftest lwt_dst_cache_ref_loop.sh executed with KASAN enabled.

Detection Methods for CVE-2025-38476

Indicators of Compromise

Kernel oops or panic messages referencing rpl_do_srh_inline or rpl_input in dmesg or /var/log/kern.log
KASAN reports of slab-use-after-free in net/ipv6/rpl_iptunnel.c on kernels built with CONFIG_KASAN=y
Unexpected process terminations or host reboots on systems using IPv6 RPL lightweight tunnels

Detection Strategies

Inventory running kernel versions and compare against the fixed commits listed in the Linux stable tree.
Identify hosts configured with RPL routes by inspecting output of ip -6 route show for encap rpl entries.
Correlate host crash telemetry with recent IPv6 traffic patterns to detect exploitation attempts.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on KASAN, BUG:, and rpl_ strings.
Track kernel package versions across the fleet and flag hosts still running unpatched builds.
Monitor for unusual IPv6 routing configuration changes made by non-administrative accounts.

How to Mitigate CVE-2025-38476

Immediate Actions Required

Apply the vendor-provided kernel update on all affected Linux and Debian systems as soon as maintenance windows allow.
Reboot patched hosts to load the fixed kernel image; live-patching solutions may cover this fix on supported distributions.
Restrict local access to hosts that cannot be immediately patched, since the attack vector is local.

Patch Information

The fix has been merged into the mainline and stable Linux trees. Reference the upstream commits: 034b428, 06ec83b, 62dcd9d, 8ba6c23, b640daa, c09e21d, and e810150. Debian users should install the updates announced in Debian LTS 2025-10-07 and Debian LTS 2025-10-08.

Workarounds

Where patching is not immediately possible, remove RPL lightweight tunnel routes (ip -6 route del ... encap rpl ...) to disable the vulnerable code path.
Disable IPv6 on hosts that do not require it, using sysctl net.ipv6.conf.all.disable_ipv6=1.
Limit which local users can create network namespaces or modify routing to reduce local attack surface.

bash

# Verify running kernel and remove any RPL-encapsulated routes
uname -r
ip -6 route show | grep -i 'encap rpl'
# Example removal (adjust destination and device to match your environment)
# ip -6 route del 2001:db8::/64 encap rpl segs 2001:db8::1 dev eth0