{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2025-38154", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-38154", "idYear": 2025, "status": "PUBLISHED", "publishedAt": "2025-07-03T08:35:57.188Z", "updatedAt": "2026-10-15T21:52:09.725Z", "importedAt": "2026-10-24T01:57:34.152Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "bpf, sockmap: Avoid using sk_socket after free when sending", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Avoid using sk_socket after free when sending\n\nThe sk->sk_socket is not locked or referenced in backlog thread, and\nduring the call to skb_send_sock(), there is a race condition with\nthe release of sk_socket. All types of sockets(tcp/udp/unix/vsock)\nwill be affected.\n\nRace conditions:\n'''\nCPU0 CPU1\n\nbacklog::skb_send_sock\n sendmsg_unlocked\n sock_sendmsg\n sock_sendmsg_nosec\n close(fd):\n ...\n ops->release() -> sock_map_close()\n sk_socket->ops = NULL\n free(socket)\n sock->ops->sendmsg\n ^\n panic here\n'''\n\nThe ref of psock become 0 after sock_map_close() executed.\n'''\nvoid sock_map_close()\n{\n ...\n if (likely(psock)) {\n ...\n // !! here we remove psock and the ref of psock become 0\n sock_map_remove_links(sk, psock)\n psock = sk_psock_get(sk);\n if (unlikely(!psock))\n goto no_psock; <=== Control jumps here via goto\n ...\n cancel_delayed_work_sync(&psock->work); <=== not executed\n sk_psock_put(sk, psock);\n ...\n}\n'''\n\nBased on the fact that we already wait for the workqueue to finish in\nsock_map_close() if psock is held, we simply increase the psock\nreference count to avoid race conditions.\n\nWith this patch, if the backlog thread is running, sock_map_close() will\nwait for the backlog thread to complete and cancel all pending work.\n\nIf no backlog running, any pending work that hasn't started by then will\nfail when invoked by sk_psock_get(), as the psock reference count have\nbeen zeroed, and sk_psock_drop() will cancel all jobs via\ncancel_delayed_work_sync().\n\nIn summary, we require synchronization to coordinate the backlog thread\nand close() thread.\n\nThe panic I catched:\n'''\nWorkqueue: events sk_psock_backlog\nRIP: 0010:sock_sendmsg+0x21d/0x440\nRAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001\n...\nCall Trace:\n \n ? die_addr+0x40/0xa0\n ? exc_general_protection+0x14c/0x230\n ? asm_exc_general_protection+0x26/0x30\n ? sock_sendmsg+0x21d/0x440\n ? sock_sendmsg+0x3e0/0x440\n ? __pfx_sock_sendmsg+0x10/0x10\n __skb_send_sock+0x543/0xb70\n sk_psock_backlog+0x247/0xb80\n...\n'''", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "4959ffc65a0e94f8acaac20deac49f89e6ded52d", "status": "affected", "versionType": "git", "lessThan": "4edb40b05cb6a261775abfd8046804ca139a5546" }, { "version": "5eabdf17fed2ad41b836bb4055ec36d95e512c50", "status": "affected", "versionType": "git", "lessThan": "b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9" }, { "version": "e946428439a0d2079959f5603256ac51b6047017", "status": "affected", "versionType": "git", "lessThan": "4c6fa65ab2aec7df94809478c8d28ef38676a1b7" }, { "version": "4b4647add7d3c8530493f7247d11e257ee425bf0", "status": "affected", "versionType": "git", "lessThan": "15c0250dae3b48a398447d2b364603821ed4ed90" }, { "version": "4b4647add7d3c8530493f7247d11e257ee425bf0", "status": "affected", "versionType": "git", "lessThan": "7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987" }, { "version": "4b4647add7d3c8530493f7247d11e257ee425bf0", "status": "affected", "versionType": "git", "lessThan": "8259eb0e06d8f64c700f5fbdb28a5c18e10de291" }, { "version": "3627605de498639a3c586c8684d12c89cba11073", "status": "affected", "versionType": "git" }, { "version": "5.15.162", "status": "affected", "versionType": "semver", "lessThan": "5.15.186" }, { "version": "6.1.95", "status": "affected", "versionType": "semver", "lessThan": "6.1.142" }, { "version": "6.6.35", "status": "affected", "versionType": "semver", "lessThan": "6.6.94" }, { "version": "6.9.6", "status": "affected", "versionType": "semver", "lessThan": "6.10" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "6.10", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "6.10" }, { "version": "5.15.186", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.142", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.94", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.34", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.15.3", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.15.*" }, { "version": "6.16", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }