CVE-2025-38273

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: tipc: fix refcount warning in tipc_aead_encrypt

syzbot reported a refcount warning [1] caused by calling get_net() on

a network namespace that is being destroyed (refcount=0). This happens

when a TIPC discovery timer fires during network namespace cleanup.

The recently added get_net() call in commit e279024617134 ("net/tipc:

fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to

hold a reference to the network namespace. However, if the namespace

is already being destroyed, its refcount might be zero, leading to the

use-after-free warning.

Replace get_net() with maybe_get_net(), which safely checks if the

refcount is non-zero before incrementing it. If the namespace is being

destroyed, return -ENODEV early, after releasing the bearer reference.

[1]: https://lore.kernel.org/all/[email protected]/T/#m12019cf9ae77e1954f666914640efa36d52704a2

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References