CVE-2025-38500: Android Linux Kernel Local Privilege Escalation Due to Use After Free in xfrmi_changelink
Summary
CVE-2025-38500: In xfrmi_changelink of xfrm_interface_core.c, there is a possible use after free due to a missing null check. Affects :linux_kernel: versions >= :0, < :2025-12-05. Fixed in :2025-12-05. How to fix ↓
Also tracked for
- linux · Debian:12
The same CVE-2025-38500 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Android operating system, responsible for managing hardware resources and providing essential services to applications. It is designed to be efficient and secure, but vulnerabilities can arise due to complex interactions between various components. This particular vulnerability affects the xfrm_interface_core.c file, which is part of the networking subsystem, specifically dealing with the IPsec framework for secure communication.
Vulnerability Detail
In the xfrmi_changelink function of xfrm_interface_core.c, a use after free vulnerability exists due to a missing null check. This flaw can lead to local privilege escalation, allowing an attacker to gain elevated privileges on the affected system without requiring additional execution privileges. The exploitation of this vulnerability does not necessitate user interaction, making it particularly concerning for system security.
How To Fix
Minimum fixed version
:2025-12-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patches as soon as they are available.
Conclusion
The CVE-2025-38500 vulnerability poses a serious risk to Android devices by allowing local privilege escalation through a use after free condition in the Linux kernel. Users are strongly advised to update their systems to the patched versions as soon as they are available to mitigate this risk.
See every vulnerability recorded for :linux_kernel: →
FAQ
CVE-2025-38500 is a vulnerability in the Android Linux kernel that allows local privilege escalation due to a use after free condition in the xfrmi_changelink function.
You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
The vulnerability can lead to unauthorized access and control over the system, allowing attackers to execute arbitrary code with elevated privileges.
No, user interaction is not needed for exploitation, making it a significant security risk.
While there are no specific workarounds, it is crucial to monitor for updates and apply the patches as soon as they become available.
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:.
