CVE-2025-38475

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smc: Fix various oops due to inet_sock type confusion.

syzbot reported weird splats [0][1] in cipso_v4_sock_setattr() while

freeing inet_sk(sk)->inet_opt.

The address was freed multiple times even though it was read-only memory.

cipso_v4_sock_setattr() did nothing wrong, and the root cause was type

confusion.

The cited commit made it possible to create smc_sock as an INET socket.

The issue is that struct smc_sock does not have struct inet_sock as the

first member but hijacks AF_INET and AF_INET6 sk_family, which confuses

various places.

In this case, inet_sock.inet_opt was actually smc_sock.clcsk_data_ready(),

which is an address of a function in the text segment.

$ pahole -C inet_sock vmlinux

struct inet_sock {

...

struct ip_options_rcu * inet_opt; /* 784 8 */

$ pahole -C smc_sock vmlinux

struct smc_sock {

...

void (*clcsk_data_ready)(

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References