CVE-2025-38618: Linux Kernel Vulnerability in vsock_bind_connectible Leading to Local Privilege Escalation
Summary
CVE-2025-38618: In __vsock_bind_connectible of af_vsock.c, there is a possible way to achieve code execution due to a use after free. Affects :linux_kernel: versions >= :0, < :2026-03-05. Fixed in :2026-03-05. How to fix ↓
Also tracked for
- linux · Debian:11
The same CVE-2025-38618 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential services such as process management, memory management, and device control. The kernel is crucial for system stability and security, making it a prime target for vulnerabilities. This specific vulnerability affects the Android ecosystem, particularly in the vsock (virtual socket) implementation, which is used for communication between virtual machines and the host system.
Vulnerability Detail
The vulnerability identified as CVE-2025-38618 arises from a use-after-free condition in the __vsock_bind_connectible function within the af_vsock.c file. This flaw can potentially allow an attacker to execute arbitrary code, leading to local privilege escalation without requiring additional execution privileges. The exploitation of this vulnerability does not necessitate user interaction, making it particularly dangerous as it can be triggered automatically by malicious processes.
How To Fix
Minimum fixed version
:2026-03-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the affected functionality by adjusting permissions or disabling the use of virtual sockets until the kernel is updated. However, this is not a permanent solution and should only be used until the patch is applied.
Conclusion
CVE-2025-38618 is a critical vulnerability in the Linux kernel that poses significant risks due to its potential for local privilege escalation. It is essential for users to update their systems to the patched version as soon as possible to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for :linux_kernel: →
FAQ
CVE-2025-38618 is a vulnerability in the Linux kernel that allows for local privilege escalation due to a use-after-free condition in the vsock_bind_connectible function.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your application without any signup.
The primary risk is local privilege escalation, which could allow an attacker to execute arbitrary code on the affected system, potentially compromising the entire system.
No, exploitation of this vulnerability does not require user interaction, making it particularly dangerous.
If immediate updates are not possible, consider implementing temporary workarounds, such as restricting access to the affected functionality.
References
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:.
