Slab Use-After-Free Vulnerability in Linux Kernel - CVE-2025-38052
Summary
CVE-2025-38052: In the Linux kernel, the following vulnerability has been resolved: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done Syzbot reported a slab-use-after-free with the following call trace: ==================... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. However, like any complex software, it is susceptible to vulnerabilities. CVE-2025-38052 is a specific vulnerability affecting the TIPC (Transparent Inter-Process Communication) subsystem, which is used for communication between processes in a distributed system.
Vulnerability Detail
CVE-2025-38052 is a slab-use-after-free vulnerability found in the tipc_aead_encrypt_done function within the Linux kernel's TIPC subsystem. This issue arises when a memory allocation is freed, but a subsequent operation still attempts to access that memory, leading to potential data corruption or system crashes. The vulnerability was reported by Syzbot and can be exploited when the TIPC crypto transmission is interrupted, allowing the cryptd_queue_worker to access freed memory. This can lead to undefined behavior and security risks in the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using the TIPC subsystem until the vulnerability is patched. This may involve disabling TIPC features in your applications or configurations that rely on it.
Conclusion
CVE-2025-38052 is a critical vulnerability in the Linux kernel's TIPC subsystem that can lead to serious security implications. It is essential for users and administrators to update their systems to the patched versions to mitigate risks. Utilizing tools like Vulert can help in monitoring vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38052 is a vulnerability in the Linux kernel's TIPC subsystem that allows for slab-use-after-free conditions, potentially leading to system instability or security breaches.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Exploitation of this vulnerability can lead to data corruption, system crashes, or unauthorized access to sensitive information, posing significant security risks.
Yes, a patch is available in the updated versions of the Linux kernel. It is recommended to update to version 6.12.32-1 or later for Debian 13.
If immediate updates are not possible, consider disabling the TIPC subsystem as a temporary workaround until you can apply the necessary patches.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
