CVE-2025-38500

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: interface: fix use-after-free after changing collect_md xfrm interface

collect_md property on xfrm interfaces can only be set on device creation,

thus xfrmi_changelink() should fail when called on such interfaces.

The check to enforce this was done only in the case where the xi was

returned from xfrmi_locate() which doesn't look for the collect_md

interface, and thus the validation was never reached.

Calling changelink would thus errornously place the special interface xi

in the xfrmi_net->xfrmi hash, but since it also exists in the

xfrmi_net->collect_md_xfrmi pointer it would lead to a double free when

the net namespace was taken down [1].

Change the check to use the xi from netdev_priv which is available earlier

in the function to prevent changes in xfrm collect_md interfaces.

[1] resulting oops:

[ 8.516540] kernel BUG at net/core/dev.c:12029!

[ 8.516552] Oops: invalid opcode: 0000 [#1] SMP NOPTI

[

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References