CVE-2025-38550: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38550 Overview

CVE-2025-38550 is a use-after-free vulnerability in the Linux kernel's IPv6 multicast (MLD) subsystem. The flaw resides in the mld_del_delrec() function within the IPv6 stack. The kernel released the reference to pmc->idev before ip6_mc_clear_src() completed its work, even though ip6_mc_clear_src() continued to dereference pmc->idev. This ordering mistake creates a window where freed memory can be accessed. A local, low-privileged attacker able to trigger the affected IPv6 multicast code path can leverage the flaw to compromise kernel confidentiality, integrity, and availability.

Critical Impact
A local attacker can exploit the use-after-free in mld_del_delrec() to corrupt kernel memory, escalate privileges, or crash the system.

Affected Products

Linux kernel (multiple stable branches, including 6.16 release candidates rc1 through rc6)
Debian Linux 11.0
Distributions shipping the affected upstream kernel versions prior to the fix commits

Discovery Timeline

2025-08-16 - CVE-2025-38550 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38550

Vulnerability Analysis

The vulnerability affects the Multicast Listener Discovery (MLD) code path in net/ipv6/mcast.c. The function mld_del_delrec() manages deletion records for IPv6 multicast group memberships tracked in the per-device idev structure. During cleanup, mld_del_delrec() released the reference counted pmc->idev pointer before calling ip6_mc_clear_src(), which still relies on pmc->idev to walk and free source-filter state.

Because the final in6_dev_put() on pmc->idev may drop the last reference and free the inet6_dev structure, any subsequent access from ip6_mc_clear_src() operates on freed memory. The fix mirrors the correct ordering already used by mld_clear_delrec(): perform ip6_mc_clear_src() first, then release the idev reference.

Root Cause

The root cause is an object-lifetime ordering bug. Reference counting on the inet6_dev object was decremented too early relative to the code that still dereferenced it. This is a classic use-after-free pattern where cleanup sequencing did not match the actual dependency graph between the freed object and its remaining users.

Attack Vector

Exploitation requires local access with low privileges. An attacker manipulates IPv6 multicast group membership on a network interface to trigger the vulnerable mld_del_delrec() path. Racing the freed idev reallocation with continued access from ip6_mc_clear_src() allows the attacker to influence kernel memory contents. Successful exploitation can lead to kernel memory corruption, information disclosure, denial of service via kernel panic, or local privilege escalation. Network access is not required because the trigger operates against the local interface state.

No verified public proof-of-concept code is available. See the upstream fix in the Kernel Git Commit #1 for the exact ordering change.

Detection Methods for CVE-2025-38550

Indicators of Compromise

Unexpected kernel oops or panic messages referencing mld_del_delrec, ip6_mc_clear_src, or in6_dev_put in dmesg and /var/log/kern.log.
KASAN reports flagging use-after-free in the IPv6 multicast code path on kernels built with sanitizers enabled.
Unprivileged processes performing repeated IPv6 multicast group joins and leaves against local interfaces, particularly on network namespaces used by containers.

Detection Strategies

Monitor kernel ring buffer output for stack traces that include mld_del_delrec or ip6_mc_clear_src symbols.
Correlate crash events with the running kernel version to identify systems still exposed to CVE-2025-38550.
Deploy audit rules to log setsockopt calls using IPV6_ADD_MEMBERSHIP and IPV6_DROP_MEMBERSHIP from unprivileged UIDs.

Monitoring Recommendations

Centralize kernel logs and alert on any panic, oops, or KASAN event referencing IPv6 multicast functions.
Track kernel package versions across the fleet and flag hosts running unpatched builds identified by the Kernel Git Commit #1.
Baseline expected IPv6 multicast activity per host so that anomalous membership churn from workloads or containers is investigated.

How to Mitigate CVE-2025-38550

Immediate Actions Required

Inventory all Linux hosts, containers, and appliances running affected kernel versions, including Debian 11 systems and 6.16 release candidates.
Apply the vendor-supplied kernel update that includes the ordering fix in mld_del_delrec() and reboot to load the patched kernel.
Restrict local shell access on multi-tenant systems and container hosts until patches are deployed.

Patch Information

The upstream fix reorders the reference release so that pmc->idev is only put after ip6_mc_clear_src() returns. Backports are available in multiple stable branches through the following commits: 5f18e01301945, 6e4eec86fe5f6, 728db00a14cac, 7929d27c747ea, ae3264a25a463, and dcbc346f50a00. Debian users should apply the update described in the Debian LTS Announcement.

Workarounds

Disable IPv6 on hosts where IPv6 connectivity is not required by setting net.ipv6.conf.all.disable_ipv6=1 and net.ipv6.conf.default.disable_ipv6=1.
Restrict creation of user and network namespaces by unprivileged users via kernel.unprivileged_userns_clone=0 to reduce the local attack surface.
Limit which workloads can join arbitrary IPv6 multicast groups by enforcing seccomp or LSM policy on container runtimes.

bash

# Configuration example: disable IPv6 as a temporary mitigation
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
echo 'net.ipv6.conf.all.disable_ipv6=1' | sudo tee -a /etc/sysctl.d/99-cve-2025-38550.conf
echo 'net.ipv6.conf.default.disable_ipv6=1' | sudo tee -a /etc/sysctl.d/99-cve-2025-38550.conf

# Restrict unprivileged user namespaces (reduces local exploit surface)
sudo sysctl -w kernel.unprivileged_userns_clone=0