CVE-2025-38464

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tipc: Fix use-after-free in tipc_conn_close().

syzbot reported a null-ptr-deref in tipc_conn_close() during netns

dismantle. [0]

tipc_topsrv_stop() iterates tipc_net(net)->topsrv->conn_idr and calls

tipc_conn_close() for each tipc_conn.

The problem is that tipc_conn_close() is called after releasing the

IDR lock.

At the same time, there might be tipc_conn_recv_work() running and it

could call tipc_conn_close() for the same tipc_conn and release its

last ->kref.

Once we release the IDR lock in tipc_topsrv_stop(), there is no

guarantee that the tipc_conn is alive.

Let's hold the ref before releasing the lock and put the ref after

tipc_conn_close() in tipc_topsrv_stop().

[0]:

BUG: KASAN: use-after-free in tipc_conn_close+0x122/0x140 net/tipc/topsrv.c:165

Read of size 8 at addr ffff888099305a08 by task kworker/u4:3/435

CPU: 0 PID: 435 Comm: kworker/u4:3 Not tainted 4.19.204-syzkaller #0

Hardware name: Google Googl

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References