CVE-2025-38464: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38464 is a use-after-free vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem, specifically in the tipc_conn_close() function during network namespace dismantling. The flaw was disclosed on July 25, 2025, and affects Linux kernel versions from 3.11 through 6.15.6, including multiple stable branches (5.4.x before 5.4.296, 5.10.x before 5.10.240, 5.15.x before 5.15.189, 6.1.x before 6.1.146, 6.6.x before 6.6.99, 6.12.x before 6.12.39, and 6.13.x before 6.15.7). Downstream distributions including Debian, Red Hat Enterprise Linux, Ubuntu, SUSE, AlmaLinux, and IBM Netezza Appliance are also affected. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a race condition (CWE-416: Use After Free) in tipc_topsrv_stop(), which iterates over TIPC connections via the IDR structure and calls tipc_conn_close() for each tipc_conn after releasing the IDR lock. A concurrent tipc_conn_recv_work() workqueue task can simultaneously call tipc_conn_close() on the same connection object and drop its last kref reference, freeing the memory. When tipc_topsrv_stop() subsequently accesses the now-freed tipc_conn, a use-after-free (reported by KASAN as a null-ptr-deref at net/tipc/topsrv.c:165) occurs. The fix requires holding an additional reference to the connection before releasing the IDR lock and releasing it only after tipc_conn_close() completes in tipc_topsrv_stop() (Red Hat Bugzilla). The vulnerability is exploitable locally with low privileges and no user interaction required.

Successful exploitation can allow a local attacker with low privileges to trigger kernel memory corruption via the use-after-free condition, potentially leading to system crashes (denial of service), kernel memory disclosure, or local privilege escalation. The vulnerability affects the availability, integrity, and confidentiality of the system, with all three rated High in the CVSS scoring. While the immediate observable effect is a kernel null-pointer dereference and system crash, the underlying memory corruption primitive could theoretically be leveraged for privilege escalation on unpatched systems (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Red Hat CVE). The vulnerability was originally discovered and reported by syzbot (Google's kernel fuzzer), which triggered the bug during network namespace dismantling. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified.

The primary remediation is to update to a patched Linux kernel version. Fixed versions include: 5.4.296, 5.10.240, 5.15.189, 6.1.146, 6.6.99, 6.12.39, and 6.15.7 (Red Hat Bugzilla). Vendor-specific patches have been released by Red Hat (RHSA-2025:14985, RHSA-2025:15005, RHSA-2025:15008, RHSA-2025:15009, RHSA-2025:15011, and others for RHEL 8/9/10 variants), Debian (DSA-5975-1), Ubuntu (USN-7774-1, USN-7774-3, USN-7774-5, USN-7775-2, USN-7775-3, USN-7879-1 through USN-7879-4, USN-7880-1, USN-7934-1), SUSE, AlmaLinux, Amazon Linux 2, and Oracle Linux 8. As a workaround where patching is not immediately possible, restricting local user access to trusted users and enabling kernel runtime protection mechanisms such as SELinux or AppArmor can reduce risk. Disabling the TIPC module (modprobe -r tipc) on systems that do not require it is also an effective mitigation.