CVE-2025-13350: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2025-13350 is a use-after-free (UAF) vulnerability in the Ubuntu Linux 6.8 kernel (Noble Numbat) that enables reliable local privilege escalation (LPE). It arises from an incorrectly backported patch that mixed legacy and new-style garbage collectors for Unix Domain Sockets (AF_UNIX). The vulnerability affects Ubuntu Linux kernel versions from 6.8.0-56.58 before 6.8.0-84.84; upstream mainline kernels and Ubuntu builds that have adopted the new GC stack (commit 4090fa373f0e) are unaffected. It was disclosed on March 5, 2026, by the Ubuntu Security Team. The CVSS v4.0 base score is 7.1 (High) (Red Hat Advisory, OSS-Sec).

The root cause (CWE-416: Use After Free) stems from Ubuntu's 6.8 GA kernel retaining the legacy AF_UNIX garbage collector while also backporting upstream commit 8594d9b85c07 ("af_unix: Don't call skb_get() for OOB skb"). When orphaned MSG_OOB sockets are processed by unix_gc(), the legacy collector calls kfree_skb() assuming OOB SKBs hold two references; however, on the affected Ubuntu kernel, they hold only the queue reference. This causes the socket buffer to be freed while still reachable, and subsequent queue walks dereference the freed memory. Exploitation requires local access with low privileges (PR:L) and high attack complexity (AC:H), with no user interaction needed. Upstream kernels were never affected because they did not cherry-pick partial pieces of the GC transition (OSS-Sec, Red Hat Advisory).

Successful exploitation yields reliable local privilege escalation on affected Ubuntu 6.8 (Noble Numbat) systems, allowing a low-privileged local attacker to gain elevated kernel-level access. The CVSS v4.0 scoring reflects high integrity and availability impact at both the vulnerable and subsequent system scopes, as well as high confidentiality impact at the system scope. This could enable an attacker to read sensitive kernel memory, modify system state, or achieve full system compromise from an unprivileged local account (Red Hat Advisory, OSS-Sec).

1. Reconnaissance: Confirm the target is running an affected Ubuntu 6.8 (Noble Numbat) kernel version between 6.8.0-56.58 and 6.8.0-84.84 (e.g., via uname -r).
2. Obtain local access: Gain a low-privileged shell on the target system (e.g., via SSH, web shell, or physical access).
3. Craft MSG_OOB socket scenario: Create orphaned AF_UNIX sockets using MSG_OOB (out-of-band) messaging to set up the conditions that trigger the legacy garbage collector path in unix_gc().
4. Trigger garbage collection: Force the kernel's legacy GC to process the orphaned OOB sockets, causing kfree_skb() to free the socket buffer that still has only one reference (the queue reference), resulting in a use-after-free condition.
5. Exploit UAF for LPE: Leverage the freed-but-still-reachable memory via subsequent queue walks to achieve controlled kernel memory corruption, enabling privilege escalation to root (OSS-Sec, Red Hat Advisory).

• Logs: Kernel oops or BUG messages in /var/log/kern.log or dmesg output referencing unix_gc(), kfree_skb(), or use-after-free in AF_UNIX socket handling.
• Process: Unexpected privilege escalation of a process (e.g., a process transitioning to UID 0 without a legitimate sudo or su invocation); unusual child processes spawned from low-privileged accounts with root privileges.
• File System: New SUID binaries, modified /etc/passwd or /etc/sudoers, or unexpected cron jobs created after a low-privileged user session.
• Network: Outbound connections from newly privileged processes to external IPs, potentially indicating post-exploitation activity.

Ubuntu has released a patched kernel version; users should upgrade to Ubuntu Linux kernel 6.8.0-84.84 or later to remediate the vulnerability. Systems running upstream mainline kernels or Ubuntu builds that have already adopted the new GC stack (commit 4090fa373f0e) are not affected and require no action. Administrators should apply available Ubuntu Security Updates promptly via apt update && apt upgrade and reboot to load the patched kernel. Restricting local user access and monitoring for privilege escalation attempts can serve as interim mitigations (OSS-Sec, Red Hat Advisory, Tenable Plugin).

The Ubuntu Security Team proactively disclosed the vulnerability via the oss-security mailing list, with Seth Arnold explicitly noting that upstream kernel users are unaffected and that the issue was specific to Ubuntu's backporting approach. The disclosure was described as a transparency measure to "give everyone peace of mind" for those consuming upstream kernels directly. The vulnerability was catalogued in the well-known linux-kernel-exploitation reference repository, indicating recognition within the kernel security research community (OSS-Sec, Linux Kernel Exploitation Repo).