CVE-2025-38734 Overview
CVE-2025-38734 is a use-after-free (UAF) vulnerability in the Linux kernel's Shared Memory Communications (SMC) subsystem. The flaw exists in the smc_listen_work() function within net/smc, where newclcsock->sk may be dereferenced after being set to NULL. The issue was discovered through BPF continuous integration testing, which produced a NULL pointer dereference oops in the kernel. A local attacker can trigger the race condition by closing the socket immediately after accept() returns, causing the kernel to reference freed memory.
Critical Impact
Local attackers can trigger kernel memory corruption leading to denial of service or potential privilege escalation on systems using SMC sockets.
Affected Products
- Linux Kernel 6.17-rc1
- Linux Kernel 6.17-rc2
- Multiple stable Linux kernel branches prior to backported fixes
Discovery Timeline
- 2025-09-05 - CVE-2025-38734 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-38734
Vulnerability Analysis
The vulnerability resides in the smc_listen_work() handler in net/smc/af_smc.c, part of the Linux kernel's Shared Memory Communications (SMC) protocol implementation. After smc_listen_out_connected() completes, the kernel invokes sk->sk_data_ready() and releases the socket lock. This creates a window where userspace can accept and immediately close the associated file descriptor. Once the socket is closed, newclcsock->sk is set to NULL. Subsequent kernel code that dereferences newclcsock->sk — such as the SMC_STAT_SERV_SUCC_INC(sock_net(newclcsock->sk)) statistics macro — triggers a NULL pointer dereference and use-after-free condition.
Root Cause
The root cause is an ordering bug classified as [CWE-416] (Use After Free). The smc_listen_work() kernel worker accesses socket state after the socket has been handed off to userspace and potentially freed. The fix reorders the code so that statistics updates and other socket accesses occur before smc_listen_out_connected() releases the socket, eliminating the race window.
Attack Vector
Exploitation requires local access and the ability to create SMC sockets. An attacker executes a userspace program that establishes an SMC listener, accepts an incoming connection, and immediately closes the accepted file descriptor. This races with the smc_hs_wq kernel workqueue processing smc_listen_work. The vulnerability requires low privileges and no user interaction, but only affects systems where the SMC protocol is enabled and reachable.
No public proof-of-concept code is available. The kernel crash trace shows the fault occurring at smc_listen_work+0xc02/0x1590 with a NULL pointer dereference at address 0x30, corresponding to the sock_net() field offset within the socket structure. See the kernel commit reference for the upstream fix details.
Detection Methods for CVE-2025-38734
Indicators of Compromise
- Kernel oops messages referencing smc_listen_work with NULL pointer dereference at address 0x30
- Unexpected crashes of the smc_hs_wq workqueue kernel worker threads
- Presence of the smc kernel module loaded on systems that do not require SMC networking
Detection Strategies
- Monitor dmesg and /var/log/kern.log for kernel panics or oops entries mentioning smc_listen_work or af_smc
- Audit running kernel version against patched stable releases using uname -r and package inventory tools
- Track process behavior for repeated rapid accept()/close() sequences on SMC sockets (AF_SMC family)
Monitoring Recommendations
- Enable kernel crash dump collection (kdump) to capture forensic evidence of exploitation attempts
- Aggregate kernel logs to a central SIEM to identify anomalous SMC-related fault patterns across the fleet
- Alert on loading of the smc kernel module on hosts where it is not part of the approved baseline
How to Mitigate CVE-2025-38734
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the vendor advisories and reboot affected systems
- Inventory hosts using the SMC protocol and prioritize patching for exposed workloads
- If the SMC subsystem is not required, blacklist the smc kernel module to eliminate the attack surface
Patch Information
The fix reorders operations in smc_listen_work() so that socket state is accessed before smc_listen_out_connected() releases the socket. Upstream commits are available at commit 070b4af4, commit 2e765ba0, commit 85545f15, and commit d9cef55e. Consult your Linux distribution vendor for backported kernel updates.
Workarounds
- Prevent loading of the SMC module by adding blacklist smc to /etc/modprobe.d/blacklist-smc.conf
- Restrict creation of AF_SMC sockets using seccomp or SELinux policies for untrusted local users
- Reduce local user access on systems where kernel patching cannot be scheduled immediately
# Configuration example: disable the SMC kernel module
echo 'blacklist smc' | sudo tee /etc/modprobe.d/blacklist-smc.conf
echo 'install smc /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-smc.conf
sudo rmmod smc 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
