CVE-2025-38097

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

espintcp: remove encap socket caching to avoid reference leak

The current scheme for caching the encap socket can lead to reference

leaks when we try to delete the netns.

The reference chain is: xfrm_state -> enacp_sk -> netns

Since the encap socket is a userspace socket, it holds a reference on

the netns. If we delete the espintcp state (through flush or

individual delete) before removing the netns, the reference on the

socket is dropped and the netns is correctly deleted. Otherwise, the

netns may not be reachable anymore (if all processes within the ns

have terminated), so we cannot delete the xfrm state to drop its

reference on the socket.

This patch results in a small (~2% in my tests) performance

regression.

A GC-type mechanism could be added for the socket cache, to clear

references if the state hasn't been used "recently", but it's a lot

more complex than just not caching the socket.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References