CVE-2025-38236: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38236 is a use-after-free vulnerability discovered in the Linux kernel's AF_UNIX sockets functionality, specifically in the unix_stream_read_generic() function. The vulnerability was reported by Jann Horn and disclosed on July 8, 2025. The issue affects the Linux kernel's AF_UNIX implementation, particularly when handling consecutive out-of-band (OOB) messages (NVD, Red Hat).

The vulnerability occurs when handling consecutive out-of-band (OOB) messages in the AF_UNIX subsystem. The issue arises because even after a user reads OOB data, the skb (socket buffer) holding the data remains in the receive queue to mark the OOB boundary. When specific sequences of OOB messages are processed, the system can end up with multiple consumed OOB skbs in the queue, leading to improper handling in the SO_PEEK_OFF code. The vulnerability has been assigned a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) (Red Hat).

The vulnerability can lead to memory corruption or privilege escalation. An unprivileged local attacker could potentially manipulate kernel memory from user space, which may result in code execution or system compromise. The impact on availability is considered Low since kernel panic is unlikely unless KASAN (Kernel Address Sanitizer) is enabled for debugging. The vulnerability is particularly concerning if kernel address layout information, such as KASLR (Kernel Address Space Layout Randomization), is exposed through the freed memory (Red Hat).

A mitigation strategy involves disabling AF_UNIX sockets usage for local users. For systems using SELinux, administrators can implement policies to prevent users from creating AF_UNIX STREAM sockets and block connections to existing sockets. The vulnerability has been fixed in various Linux distributions, with patches available for affected versions. For example, Debian has fixed the issue in version 6.12.37-1 for sid, while some versions like bullseye are not affected due to the vulnerable code not being present (Debian, Red Hat).