CVE-2025-38666: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38666 Overview

CVE-2025-38666 is a use-after-free vulnerability [CWE-416] in the Linux kernel's AppleTalk Address Resolution Protocol (AARP) proxy probe routine. The flaw resides in aarp_proxy_probe_network() inside net/appletalk/aarp.c. The function sends a probe, releases aarp_lock, sleeps, and then re-acquires the lock. During that window, the expire timer thread __aarp_expire_timer can remove and kfree() the same entry, producing a use-after-free condition when the probe routine dereferences freed memory.

The issue affects Linux kernel versions from 2.6.12 through 6.16-rc7 and Debian Linux 11.0. Successful exploitation requires local access with low privileges and can lead to memory corruption and potential privilege escalation.

Critical Impact
A local, low-privileged user can trigger a race between the AARP proxy probe and the AARP expire timer to corrupt kernel memory, leading to denial of service or potential privilege escalation on affected Linux systems where the AppleTalk module is loaded.

Affected Products

Linux kernel versions 2.6.12 through 6.16-rc7
Debian Linux 11.0
Any distribution shipping the AppleTalk (appletalk) module built and loadable

Discovery Timeline

2025-08-22 - CVE-2025-38666 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38666

Vulnerability Analysis

The vulnerability is a classic time-of-check/time-of-use race condition producing a use-after-free in the AppleTalk subsystem. The proxy probe routine aarp_proxy_probe_network() allocates an aarp_entry, inserts it into the proxies[hash] table, transmits a probe, then drops aarp_lock and calls msleep(100) before reacquiring the lock and dereferencing the entry.

The aarp_send_ddp() path arms a timer via mod_timer() with a roughly 200ms timeout. When the timer fires on another CPU, aarp_expire_timeout() acquires aarp_lock, calls __aarp_expire_timer(), and frees the same aarp_entry object via kfree(). When the original thread wakes and re-acquires the lock, it reads freed slab memory, which KASAN reports as a slab-use-after-free on a 192-byte kmalloc-192 object.

Root Cause

The root cause is inadequate reference protection across a sleeping window. The code releases aarp_lock and sleeps without either taking a reference on the aarp_entry, marking it as busy, or preventing the expire timer from freeing it. The lock alone does not serialize the two threads because the probe routine explicitly releases it.

Attack Vector

A local attacker with permission to open AppleTalk sockets and issue ioctl calls can trigger the race by invoking SIOCATALKDIFADDR and related requests handled by atif_ioctl(), which reach atif_proxy_probe_device() and ultimately aarp_proxy_probe_network(). Concurrent traffic and timer expirations increase the probability of hitting the free-before-use window. Exploitation of the resulting freed slab object can lead to controlled memory corruption in the kernel heap.

The KASAN report referenced in the upstream commit shows the freed 192-byte allocation and the offending read at net/appletalk/aarp.c:493 during proxy probe execution. See the upstream fix commit e4f1564 and additional stable backports for the corrected locking pattern.

Detection Methods for CVE-2025-38666

Indicators of Compromise

Kernel log entries containing KASAN: slab-use-after-free in aarp_proxy_probe_network on debug kernels
Unexpected kernel oops or panic traces referencing aarp_proxy_probe_network, __aarp_expire_timer, or aarp_expire_timeout
Loading of the appletalk kernel module on systems where AppleTalk is not required (lsmod | grep appletalk)

Detection Strategies

Monitor for the appletalk module being loaded via modprobe or auto-load, using auditd rules on init_module and finit_module syscalls
Alert on process creations that open AF_APPLETALK sockets or issue AppleTalk-related ioctl calls from non-administrative accounts
Correlate kernel crash dumps and dmesg output containing AARP function symbols with the affected user session

Monitoring Recommendations

Ingest /var/log/kern.log, dmesg, and journald kernel messages into a central log platform and alert on aarp_ symbol strings
Track kernel version and patch state across the fleet to identify hosts still running kernels earlier than the patched stable releases
Baseline the set of loaded kernel modules per host and alert on additions of legacy protocol modules such as appletalk, dccp, or rds

How to Mitigate CVE-2025-38666

Immediate Actions Required

Apply the vendor-supplied kernel update from your Linux distribution that incorporates the upstream AARP fix
Blacklist the appletalk module on systems that do not require AppleTalk connectivity, which is the case for virtually all modern deployments
Restrict local shell access and enforce least privilege to reduce the population of users able to reach the vulnerable ioctl path

Patch Information

The fix has been merged upstream and backported across multiple stable branches. Refer to the following commits: 186942d, 2a6209e, 5f02ea0, 6c4a92d, 82d19a7, b35694f, e4f1564, and f90b6bb. Debian users should install the packages referenced in Debian LTS DLA advisory #00007 and DLA advisory #00008.

Workarounds

Prevent load of the vulnerable module by adding install appletalk /bin/true to a file under /etc/modprobe.d/
Unload the module at runtime with rmmod appletalk when no active AppleTalk sockets are in use
Deny CAP_NET_ADMIN and restrict use of AF_APPLETALK sockets via seccomp or LSM policies on multi-tenant hosts

bash

# Disable the AppleTalk module to eliminate the attack surface
echo 'blacklist appletalk' | sudo tee /etc/modprobe.d/blacklist-appletalk.conf
echo 'install appletalk /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-appletalk.conf
sudo rmmod appletalk 2>/dev/null || true
sudo update-initramfs -u