CVE-2025-38079

Published: Jun 18, 2025Modified: Jul 30, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double free in hash_accept If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_release, leading to slab-use-after-free error.

Affected (15)

Products: Linux: Linux Kernel · Debian: Debian Linux

1 product

1 product

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	2.6.38 ≤ version < 5.4.294
Linux Linux Kernel	5.11 ≤ version < 5.15.185
Linux Linux Kernel	5.16 ≤ version < 6.1.141
Linux Linux Kernel	5.5 ≤ version < 5.10.238
Linux Linux Kernel	6.13 ≤ version < 6.14.9
Linux Linux Kernel	6.2 ≤ version < 6.6.93
Linux Linux Kernel	6.7 ≤ version < 6.12.31
Linux Linux Kernel	Version 6.15 rc1
Linux Linux Kernel	Version 6.15 rc2
Linux Linux Kernel	Version 6.15 rc3
Linux Linux Kernel	Version 6.15 rc4
Linux Linux Kernel	Version 6.15 rc5
Linux Linux Kernel	Version 6.15 rc6
Linux Linux Kernel	Version 6.15 rc7

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 11.0

Related CWEs

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References (11)

https://git.kernel.org/stable/c/0346f4b742345d1c733c977f3a7aef5a6419a967

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/134daaba93193df9e988524b5cd2f52d15eb1993

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/2f45a8d64fb4ed4830a4b3273834ecd6ca504896

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/5bff312b59b3f2a54ff504e4f4e47272b64f3633

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/b2df03ed4052e97126267e8c13ad4204ea6ba9b6

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/bf7bba75b91539e93615f560893a599c1e1c98bf

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/c3059d58f79fdfb2201249c2741514e34562b547

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/f0f3d09f53534ea385d55ced408f2b67059b16e4

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Timeline

No history available yet.