CVE-2025-38273

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: tipc: fix refcount warning in tipc_aead_encrypt

syzbot reported a refcount warning [1] caused by calling get_net() on

a network namespace that is being destroyed (refcount=0). This happens

when a TIPC discovery timer fires during network namespace cleanup.

The recently added get_net() call in commit e279024617134 ("net/tipc:

fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to

hold a reference to the network namespace. However, if the namespace

is already being destroyed, its refcount might be zero, leading to the

use-after-free warning.

Replace get_net() with maybe_get_net(), which safely checks if the

refcount is non-zero before incrementing it. If the namespace is being

destroyed, return -ENODEV early, after releasing the bearer reference.

[1]: https://lore.kernel.org/all/[email protected]/T/#m12019cf9ae77e1954f666914640efa36d52704a2

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References