CVE-2025-38097

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38097
In the Linux kernel, the following vulnerability has been resolved: espintcp: remove encap socket caching to avoid reference leak The current scheme for caching the encap socket can lead to reference leaks when we try to delete the netns. The reference chain is: xfrm_state -> enacp_sk -> netns Since the encap socket is a userspace socket, it holds a reference on the netns. If we delete the espintcp state (through flush or individual delete) before removing the netns, the reference on the socket is dropped and the netns is correctly deleted. Otherwise, the netns may not be reachable anymore (if all processes within the ns have terminated), so we cannot delete the xfrm state to drop its reference on the socket. This patch results in a small (~2% in my tests) performance regression. A GC-type mechanism could be added for the socket cache, to clear references if the state hasn't been used "recently", but it's a lot more complex than just not caching the socket.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/028363685bd0b7a19b4a820f82dd905b1dc83999 Patch
https://git.kernel.org/stable/c/74fd327767fb784c5875cf7c4ba1217f26020943 Patch
https://git.kernel.org/stable/c/9cbca30102028f9ad3d2098f935c4368f581fd07 Patch
https://git.kernel.org/stable/c/b58a295d10065960bcb9d60cb8ca6ead9837cd27 Patch
https://git.kernel.org/stable/c/e4cde54b46a87231c77256a633be1bef62687d69 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

16 Dec 2025, 17:16

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
CWE NVD-CWE-Other
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/028363685bd0b7a19b4a820f82dd905b1dc83999 - () https://git.kernel.org/stable/c/028363685bd0b7a19b4a820f82dd905b1dc83999 - Patch
References () https://git.kernel.org/stable/c/74fd327767fb784c5875cf7c4ba1217f26020943 - () https://git.kernel.org/stable/c/74fd327767fb784c5875cf7c4ba1217f26020943 - Patch
References () https://git.kernel.org/stable/c/9cbca30102028f9ad3d2098f935c4368f581fd07 - () https://git.kernel.org/stable/c/9cbca30102028f9ad3d2098f935c4368f581fd07 - Patch
References () https://git.kernel.org/stable/c/b58a295d10065960bcb9d60cb8ca6ead9837cd27 - () https://git.kernel.org/stable/c/b58a295d10065960bcb9d60cb8ca6ead9837cd27 - Patch
References () https://git.kernel.org/stable/c/e4cde54b46a87231c77256a633be1bef62687d69 - () https://git.kernel.org/stable/c/e4cde54b46a87231c77256a633be1bef62687d69 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory, Mailing List

03 Nov 2025, 18:16

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: espintcp: eliminar el almacenamiento en caché del socket encap para evitar fugas de referencia El esquema actual para almacenar en caché el socket encap puede provocar fugas de referencia cuando intentamos eliminar los netns. La cadena de referencia es: xfrm_state -> enacp_sk -> netns Dado que el socket encap es un socket de espacio de usuario, contiene una referencia en los netns. Si eliminamos el estado de espintcp (a través de vaciado o eliminación individual) antes de eliminar los netns, la referencia en el socket se elimina y los netns se eliminan correctamente. De lo contrario, los netns pueden no ser accesibles más (si todos los procesos dentro de los ns han terminado), por lo que no podemos eliminar el estado xfrm para eliminar su referencia en el socket. Este parche da como resultado una pequeña regresión del rendimiento (~2% en mis pruebas). Se podría agregar un mecanismo de tipo GC para el caché del socket, para borrar referencias si el estado no se ha usado "recientemente", pero es mucho más complejo que simplemente no almacenar en caché el socket.
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

03 Jul 2025, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-03 09:15

Updated : 2025-12-16 17:16

NVD link : CVE-2025-38097

Mitre link : CVE-2025-38097

CVE.ORG link : CVE-2025-38097

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
NVD-CWE-Other