CVE-2025-38154

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Avoid using sk_socket after free when sending

The sk->sk_socket is not locked or referenced in backlog thread, and

during the call to skb_send_sock(), there is a race condition with

the release of sk_socket. All types of sockets(tcp/udp/unix/vsock)

will be affected.

Race conditions:

'''

CPU0 CPU1

backlog::skb_send_sock

sendmsg_unlocked

sock_sendmsg

sock_sendmsg_nosec

close(fd):

...

ops->release() -> sock_map_close()

sk_socket->ops = NULL

free(socket)

sock->ops->sendmsg

^

panic here

'''

The ref of psock become 0 after sock_map_close() executed.

'''

void sock_map_close()

{

...

if (likely(psock)) {

...

// !! here we remove psock and the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References