CVE-2025-38718: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38718 Overview

CVE-2025-38718 is a Linux kernel vulnerability in the Stream Control Transmission Protocol (SCTP) receive path. The flaw resides in sctp_rcv() where cloned Generic Segmentation Offload (GSO) packets share fragment skb structures in fraglist with the original head skb. Accessing these shared frag skbs is unsafe and results in uninitialized memory reads, as reported by syzbot through two Kernel Memory Sanitizer (KMSAN) bugs in sctp_inq_pop() and sctp_assoc_bh_rcv(). The vulnerability is categorized under [CWE-908] Use of Uninitialized Resource. Affected systems include multiple Linux kernel versions and Debian Linux 11.0.

Critical Impact
A local attacker with low privileges can trigger uninitialized memory access in the kernel SCTP stack, potentially leading to information disclosure, memory corruption, or system compromise.

Affected Products

Linux Kernel (multiple versions through 6.17-rc1)
Debian Linux 11.0
Distributions shipping vulnerable Linux kernel builds with SCTP enabled

Discovery Timeline

2025-09-04 - CVE CVE-2025-38718 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38718

Vulnerability Analysis

The vulnerability affects the SCTP receive path in the Linux kernel networking stack. When SCTP processes incoming packets that were reassembled via GSO, the kernel may operate on a cloned sk_buff (head skb). A cloned head skb retains a reference to the same fragment skb list (fraglist) as the original.

Because these fragment skbs are shared, subsequent access in sctp_rcv() and downstream functions such as sctp_inq_pop() (net/sctp/inqueue.c:211) and sctp_assoc_bh_rcv() (net/sctp/associola.c:987) can dereference memory whose initialization state is not guaranteed. Syzbot reproduced this behavior with KMSAN, producing uninit-value reports during sctp_sendmsg operations that trigger receive-side processing via the backlog path.

The consequence is undefined behavior in kernel context. Uninitialized reads can leak kernel memory contents into decision paths, corrupt SCTP association state, or crash the kernel. Reachability requires the SCTP module to be loaded and an attacker able to send or induce SCTP traffic.

Root Cause

The root cause is improper handling of cloned GSO skbs in sctp_rcv(). The clone operation copies the head buffer but not the fragment list, leaving both the original and clone pointing at the same fraglist entries. Modifications or reads through the cloned head produce non-deterministic memory access patterns, which manifest as CWE-908 uninitialized resource use.

Attack Vector

Exploitation requires local access with low privileges to invoke SCTP socket operations. An attacker calls sctp_sendmsg() or otherwise induces SCTP traffic processing that reaches sctp_backlog_rcv() -> sctp_inq_push() -> sctp_assoc_bh_rcv() -> sctp_inq_pop(). When cloned GSO packets are present, the shared fragment access triggers the flaw. No user interaction is required beyond the local attacker's own socket calls.

No public proof-of-concept exploit is currently listed for this CVE. The vulnerability was surfaced by syzbot fuzzing rather than in-the-wild attacks.

Detection Methods for CVE-2025-38718

Indicators of Compromise

Kernel oops, panic, or KASAN/KMSAN reports referencing sctp_inq_pop, sctp_assoc_bh_rcv, or sctp_rcv in stack traces.
Unexpected SCTP association resets or protocol errors on hosts with the SCTP module loaded.
Local processes with SCTP socket activity that do not match documented application behavior.

Detection Strategies

Monitor kernel logs (dmesg, journalctl -k) for SCTP-related warnings, BUG: entries, or memory sanitizer output.
Inventory hosts where the sctp kernel module is loaded (lsmod | grep sctp) and correlate against required business use.
Track unprivileged processes that create SCTP sockets (socket(AF_INET, SOCK_SEQPACKET, IPPROTO_SCTP)) using audit rules.

Monitoring Recommendations

Enable Linux audit rules on the socket syscall filtering for SCTP protocol families and alert on unexpected invocations.
Ingest kernel logs into a centralized SIEM and alert on repeated crashes in SCTP call paths.
Track kernel package versions across the fleet and flag hosts running unpatched kernel builds.

How to Mitigate CVE-2025-38718

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits and reboot affected systems.
Update Debian systems using the Debian LTS Announcement advisory.
If SCTP is not required, unload and blacklist the module to remove the attack surface entirely.
Prioritize patching multi-tenant hosts and systems accessible to low-privileged local users.

Patch Information

The fix linearizes cloned GSO packets in sctp_rcv() so that fragment skbs are no longer shared between the head clone and the original. Patches are available in the stable Linux kernel tree, including commits 03d0cc68, 1bd5214e, 4506bcaa, 7d757f17, cd0e92bb, d0194e39, ea094f38, fc667726, and fd60d8a0.

Workarounds

Blacklist the SCTP kernel module on hosts that do not require it by adding blacklist sctp and install sctp /bin/true to /etc/modprobe.d/.
Restrict use of SCTP sockets via seccomp or AppArmor profiles for untrusted local users.
Apply strict user segmentation to limit which local accounts can open raw or protocol-specific sockets.

bash

# Configuration example: disable the SCTP module where not required
echo "blacklist sctp" | sudo tee /etc/modprobe.d/blacklist-sctp.conf
echo "install sctp /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-sctp.conf
sudo rmmod sctp 2>/dev/null || true
lsmod | grep sctp || echo "SCTP module not loaded"