Reference Leak Vulnerability in Linux Kernel's espintcp Package
Summary
CVE-2025-38097: In the Linux kernel, the following vulnerability has been resolved: espintcp: remove encap socket caching to avoid reference leak The current scheme for caching the encap socket can lead to reference leaks when we try to... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. The espintcp module is responsible for handling encapsulated TCP connections. This module is critical for secure communications, particularly in networking contexts. However, it has been found to have a vulnerability that can lead to reference leaks, potentially affecting system stability and security.
Vulnerability Detail
In the Linux kernel, the espintcp module's current scheme for caching the encapsulated socket can lead to reference leaks when attempting to delete the network namespace (netns). The reference chain is established as follows: xfrm_state -> encap_sk -> netns. When the espintcp state is deleted before the netns, the reference on the socket is dropped, allowing for proper deletion of the netns. However, if the netns is not reachable (e.g., all processes within the namespace have terminated), the xfrm state cannot be deleted, leading to a reference leak. This vulnerability can result in resource exhaustion and system instability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to monitor the system for any unusual behavior and apply the patch as soon as it becomes available.
Conclusion
The espintcp vulnerability in the Linux kernel poses a significant risk due to potential reference leaks that can affect system stability. It is crucial to apply the available patches and monitor your systems for any signs of exploitation. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
The espintcp module in the Linux kernel is responsible for managing encapsulated TCP connections, which are essential for secure networking.
This vulnerability can lead to reference leaks, which may cause resource exhaustion and system instability, potentially impacting the performance of your applications.
Yes, a patch is available for Debian 13 in version 6.12.32-1. Users of Debian 11 and 12 should check for updates as they may not yet have a fixed version.
If you cannot update immediately, monitor your system for unusual behavior and consider isolating affected services until a patch can be applied.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground at Vulert Scanner without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
