In the Linux kernel, the following vulnerability has been resolved:
net: tipc: fix refcount warning in tipcaeadencrypt
syzbot reported a refcount warning [1] caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup.
The recently added getnet() call in commit e279024617134 ("net/tipc: fix slab-use-after-free Read in tipcaeadencryptdone") attempts to hold a reference to the network namespace. However, if the namespace is already being destroyed, its refcount might be zero, leading to the use-after-free warning.
Replace getnet() with maybeget_net(), which safely checks if the refcount is non-zero before incrementing it. If the namespace is being destroyed, return -ENODEV early, after releasing the bearer reference.
[
{
"id": "CVE-2025-38273-03c58401",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acab7ca5ff19889b80a8ee7dec220ee1a96dede9",
"target": {
"file": "net/tipc/crypto.c",
"function": "tipc_aead_encrypt"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1982.0,
"function_hash": "249838915095648708123920437951149117131"
}
},
{
"id": "CVE-2025-38273-0b931bf8",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ff60e0d9974dccf24e89bcd3ee7933e538d929f",
"target": {
"file": "net/tipc/crypto.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"49272745555140976653127752687543726084",
"3314430955819227824695654573922818126",
"7487966368241304390059373558157299869",
"92399292721906798604059315038083284420"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38273-2c304b05",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@445d59025d76d0638b03110f8791d5b89ed5162d",
"target": {
"file": "net/tipc/crypto.c",
"function": "tipc_aead_encrypt"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 2076.0,
"function_hash": "111910186681744898093472892810655840948"
}
},
{
"id": "CVE-2025-38273-2fca9d08",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ff60e0d9974dccf24e89bcd3ee7933e538d929f",
"target": {
"file": "net/tipc/crypto.c",
"function": "tipc_aead_encrypt"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1982.0,
"function_hash": "249838915095648708123920437951149117131"
}
},
{
"id": "CVE-2025-38273-3513a49f",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f29ccaa07cf3d35990f4d25028cc55470d29372b",
"target": {
"file": "net/tipc/crypto.c",
"function": "tipc_aead_encrypt"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1982.0,
"function_hash": "249838915095648708123920437951149117131"
}
},
{
"id": "CVE-2025-38273-38d423ec",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029",
"target": {
"file": "net/tipc/crypto.c",
"function": "tipc_aead_encrypt"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 2089.0,
"function_hash": "19965068495660650508666620384922664277"
}
},
{
"id": "CVE-2025-38273-3d9d6ff0",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@307391e8fe70401a6d39ecc9978e13c2c0cdf81f",
"target": {
"file": "net/tipc/crypto.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"49272745555140976653127752687543726084",
"3314430955819227824695654573922818126",
"7487966368241304390059373558157299869",
"92399292721906798604059315038083284420"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38273-4d9523a5",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@307391e8fe70401a6d39ecc9978e13c2c0cdf81f",
"target": {
"file": "net/tipc/crypto.c",
"function": "tipc_aead_encrypt"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1982.0,
"function_hash": "249838915095648708123920437951149117131"
}
},
{
"id": "CVE-2025-38273-5b2c2560",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c762fc79d710d676b793f9d98b1414efe6eb51e6",
"target": {
"file": "net/tipc/crypto.c",
"function": "tipc_aead_encrypt"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1982.0,
"function_hash": "249838915095648708123920437951149117131"
}
},
{
"id": "CVE-2025-38273-69106d6f",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f29ccaa07cf3d35990f4d25028cc55470d29372b",
"target": {
"file": "net/tipc/crypto.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"49272745555140976653127752687543726084",
"3314430955819227824695654573922818126",
"7487966368241304390059373558157299869",
"92399292721906798604059315038083284420"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38273-7ae2b7bf",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029",
"target": {
"file": "net/tipc/crypto.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"49272745555140976653127752687543726084",
"3314430955819227824695654573922818126",
"7487966368241304390059373558157299869",
"92399292721906798604059315038083284420"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38273-b2ed197d",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@445d59025d76d0638b03110f8791d5b89ed5162d",
"target": {
"file": "net/tipc/crypto.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"49272745555140976653127752687543726084",
"3314430955819227824695654573922818126",
"7487966368241304390059373558157299869",
"92399292721906798604059315038083284420"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38273-b762852c",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acab7ca5ff19889b80a8ee7dec220ee1a96dede9",
"target": {
"file": "net/tipc/crypto.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"49272745555140976653127752687543726084",
"3314430955819227824695654573922818126",
"7487966368241304390059373558157299869",
"92399292721906798604059315038083284420"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38273-cae64eba",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c762fc79d710d676b793f9d98b1414efe6eb51e6",
"target": {
"file": "net/tipc/crypto.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"49272745555140976653127752687543726084",
"3314430955819227824695654573922818126",
"7487966368241304390059373558157299869",
"92399292721906798604059315038083284420"
],
"threshold": 0.9
}
}
]