Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-38212

ipc: fix to protect IPCS lookups using RCU

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.95, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookups using RCU syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/ idr_for_each() is protected by rwsem, but this is not enough. If it is not protected by RCU read-critical region, when idr_for_each() calls radix_tree_node_free() through call_rcu() to free the radix_tree_node structure, the node will be freed immediately, and when reading the next node in radix_tree_for_each_slot(), the already freed memory may be read. Therefore, we need to add code to make sure that idr_for_each() is protected within the RCU read-critical region when we call it in shm_destroy_orphaned().

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From b34a6b1da371ed8af1221459a18c67970f7e3d53 · fixed in 5f1e1573bf103303944fd7225559de5d8297539c; From b34a6b1da371ed8af1221459a18c67970f7e3d53 · fixed in b968ba8bfd9f90914957bbbd815413bf6a98eca7; From b34a6b1da371ed8af1221459a18c67970f7e3d53 · fixed in 74bc813d11c30e28fc5261dc877cca662ccfac68; From b34a6b1da371ed8af1221459a18c67970f7e3d53 · fixed in 78297d53d3878d43c1d627d20cd09f611fa4b91d; From b34a6b1da371ed8af1221459a18c67970f7e3d53 · fixed in 5180561afff8e0f029073c8c8117c95c6512d1f9; From b34a6b1da371ed8af1221459a18c67970f7e3d53 · fixed in 68c173ea138b66d7dd1fd980c9bc578a18e11884; From b34a6b1da371ed8af1221459a18c67970f7e3d53 · fixed in b0b6bf90ce2699a574b3683e22c44d0dcdd7a057; From b34a6b1da371ed8af1221459a18c67970f7e3d53 · fixed in d66adabe91803ef34a8b90613c81267b5ded1472

  • Linux Linux

    3.1

  • KernelLinux

    From 3.1.0 · fixed in 5.4.295; From 5.5.0 · fixed in 5.10.239; From 5.11.0 · fixed in 5.15.186; From 5.16.0 · fixed in 6.1.142; From 6.2.0 · fixed in 6.6.95; From 6.7.0 · fixed in 6.12.35; From 6.13.0 · fixed in 6.15.4

References 8

git.kernel.org