CVE-2025-38554

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped

By inducing delays in the right places, Jann Horn created a reproducer for

a hard to hit UAF issue that became possible after VMAs were allowed to be

recycled by adding SLAB_TYPESAFE_BY_RCU to their cache.

Race description is borrowed from Jann's discovery report:

lock_vma_under_rcu() looks up a VMA locklessly with mas_walk() under

rcu_read_lock(). At that point, the VMA may be concurrently freed, and it

can be recycled by another process. vma_start_read() then increments the

vma->vm_refcnt (if it is in an acceptable range), and if this succeeds,

vma_start_read() can return a recycled VMA.

In this scenario where the VMA has been recycled, lock_vma_under_rcu()

will then detect the mismatching ->vm_mm pointer and drop the VMA through

vma_end_read(), which calls vma_refcount_put(). vma_refcount_put() drops

the refcount and then calls rcuwait_wake_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References