In the Linux kernel, the following vulnerability has been resolved:
net: appletalk: Fix use-after-free in AARP proxy probe
The AARP proxy‐probe routine (aarpproxyprobenetwork) sends a probe, releases the aarplock, sleeps, then re-acquires the lock. During that window an expire timer thread (_aarpexpire_timer) can remove and kfree() the same entry, leading to a use-after-free.
race condition:
cpu 0 | cpu 1
atalk_sendmsg() | atif_proxy_probe_device()
aarp_send_ddp() | aarp_proxy_probe_network()
mod_timer() | lock(aarp_lock) // LOCK!!
timeout around 200ms | alloc(aarp_entry)
and then call | proxies[hash] = aarp_entry
aarp_expire_timeout() | aarp_send_probe()
| unlock(aarp_lock) // UNLOCK!!
lock(aarp_lock) // LOCK!! | msleep(100);
__aarp_expire_timer(&proxies[ct]) |
free(aarp_entry) |
unlock(aarp_lock) // UNLOCK!! |
| lock(aarp_lock) // LOCK!!
| UAF aarp_entry !!
================================================================== BUG: KASAN: slab-use-after-free in aarpproxyprobe_network+0x560/0x630 net/appletalk/aarp.c:493 Read of size 4 at addr ffff8880123aa360 by task repro/13278
CPU: 3 UID: 0 PID: 13278 Comm: repro Not tainted 6.15.2 #3 PREEMPT(full) Call Trace: <TASK> _dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x116/0x1b0 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:408 [inline] printreport+0xc1/0x630 mm/kasan/report.c:521 kasanreport+0xca/0x100 mm/kasan/report.c:634 aarpproxyprobenetwork+0x560/0x630 net/appletalk/aarp.c:493 atifproxyprobedevice net/appletalk/ddp.c:332 [inline] atifioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 atalkioctl+0x198/0x2f0 net/appletalk/ddp.c:1818 sockdoioctl+0xdc/0x260 net/socket.c:1190 sockioctl+0x239/0x6a0 net/socket.c:1311 vfsioctl fs/ioctl.c:51 [inline] _dosysioctl fs/ioctl.c:906 [inline] _sesysioctl fs/ioctl.c:892 [inline] _x64sysioctl+0x194/0x200 fs/ioctl.c:892 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xcb/0x250 arch/x86/entry/syscall64.c:94 entrySYSCALL64after_hwframe+0x77/0x7f </TASK>
Allocated: aarpalloc net/appletalk/aarp.c:382 [inline] aarpproxyprobenetwork+0xd8/0x630 net/appletalk/aarp.c:468 atifproxyprobedevice net/appletalk/ddp.c:332 [inline] atifioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818
Freed: kfree+0x148/0x4d0 mm/slub.c:4841 _aarpexpire net/appletalk/aarp.c:90 [inline] _aarpexpiretimer net/appletalk/aarp.c:261 [inline] aarpexpire_timeout+0x480/0x6e0 net/appletalk/aarp.c:317
The buggy address belongs to the object at ffff8880123aa300 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 96 bytes inside of freed 192-byte region [ffff8880123aa300, ffff8880123aa3c0)
Memory state around the buggy address: ffff8880123aa200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880123aa280: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880123aa300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880123aa380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8880123aa400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[
{
"id": "CVE-2025-38666-03761734",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a6209e4649d45fd85d4193abc481911858ffc6f",
"target": {
"file": "net/appletalk/aarp.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"73854990650700581868678392597181926646",
"263303934906244969492656116273746606367",
"200884772068156373394057522350610049293",
"163084269581594057276739236106591127978",
"216495261570935422834873764371186102979",
"279397528589569221729858028047705484060",
"180027262036980093018403653948546520078",
"129404743141437446170204429883748330787",
"319669574524256283827147139203221193288",
"97978373482137096330915800241991792561",
"72474082752636521865967004360336809646",
"240119635759487087803777011158487277275",
"304197330181340102458894783057954339787",
"93214540177594444906051492912543926126",
"229719616580827340883150016063601463139",
"1116079169046935464483898028063167908",
"179707877475520199201259944704476963255",
"156261536345107652362924349752541376952",
"323305606234630414280061400136887174894",
"269641696223797824104137154422300274051",
"45626868918861249996839155811922354794",
"148559629402009255648760956588614658158",
"16537974276516467229010094575779824734",
"217316264596944149682871359500987344654",
"304428554886377331385924044876703443175",
"174204708076407221909548189426200278855",
"98643044313704146644431276130602401824",
"100301250077684177536773056645678580846"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38666-0e9df275",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a6209e4649d45fd85d4193abc481911858ffc6f",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_alloc"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 157.0,
"function_hash": "273577078198146005587710424504775957257"
}
},
{
"id": "CVE-2025-38666-319440f1",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@186942d19c0222617ef61f50e1dba91e269a5963",
"target": {
"file": "net/appletalk/aarp.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"73854990650700581868678392597181926646",
"263303934906244969492656116273746606367",
"200884772068156373394057522350610049293",
"163084269581594057276739236106591127978",
"216495261570935422834873764371186102979",
"279397528589569221729858028047705484060",
"180027262036980093018403653948546520078",
"129404743141437446170204429883748330787",
"319669574524256283827147139203221193288",
"97978373482137096330915800241991792561",
"72474082752636521865967004360336809646",
"240119635759487087803777011158487277275",
"304197330181340102458894783057954339787",
"93214540177594444906051492912543926126",
"229719616580827340883150016063601463139",
"1116079169046935464483898028063167908",
"179707877475520199201259944704476963255",
"156261536345107652362924349752541376952",
"323305606234630414280061400136887174894",
"269641696223797824104137154422300274051",
"45626868918861249996839155811922354794",
"148559629402009255648760956588614658158",
"16537974276516467229010094575779824734",
"217316264596944149682871359500987344654",
"304428554886377331385924044876703443175",
"174204708076407221909548189426200278855",
"98643044313704146644431276130602401824",
"100301250077684177536773056645678580846"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38666-3531f328",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82d19a70ced28b17a38ebf1b6978c6c7db894979",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_proxy_probe_network"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1001.0,
"function_hash": "14660294563874566865754199465454365850"
}
},
{
"id": "CVE-2025-38666-47a40018",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f02ea0f63dd38c41539ea290fcc1693c73aa8e5",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_alloc"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 157.0,
"function_hash": "273577078198146005587710424504775957257"
}
},
{
"id": "CVE-2025-38666-4999c681",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a6209e4649d45fd85d4193abc481911858ffc6f",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_proxy_probe_network"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1001.0,
"function_hash": "14660294563874566865754199465454365850"
}
},
{
"id": "CVE-2025-38666-55238b8f",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c4a92d07b0850342d3becf2e608f805e972467c",
"target": {
"file": "net/appletalk/aarp.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"73854990650700581868678392597181926646",
"263303934906244969492656116273746606367",
"200884772068156373394057522350610049293",
"163084269581594057276739236106591127978",
"216495261570935422834873764371186102979",
"279397528589569221729858028047705484060",
"180027262036980093018403653948546520078",
"129404743141437446170204429883748330787",
"319669574524256283827147139203221193288",
"97978373482137096330915800241991792561",
"72474082752636521865967004360336809646",
"240119635759487087803777011158487277275",
"304197330181340102458894783057954339787",
"93214540177594444906051492912543926126",
"229719616580827340883150016063601463139",
"1116079169046935464483898028063167908",
"179707877475520199201259944704476963255",
"156261536345107652362924349752541376952",
"323305606234630414280061400136887174894",
"269641696223797824104137154422300274051",
"45626868918861249996839155811922354794",
"148559629402009255648760956588614658158",
"16537974276516467229010094575779824734",
"217316264596944149682871359500987344654",
"304428554886377331385924044876703443175",
"174204708076407221909548189426200278855",
"98643044313704146644431276130602401824",
"100301250077684177536773056645678580846"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38666-5e6340f8",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f90b6bb203f3f38bf2b3d976113d51571df9a482",
"target": {
"file": "net/appletalk/aarp.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"73854990650700581868678392597181926646",
"263303934906244969492656116273746606367",
"200884772068156373394057522350610049293",
"163084269581594057276739236106591127978",
"216495261570935422834873764371186102979",
"279397528589569221729858028047705484060",
"180027262036980093018403653948546520078",
"129404743141437446170204429883748330787",
"319669574524256283827147139203221193288",
"97978373482137096330915800241991792561",
"72474082752636521865967004360336809646",
"240119635759487087803777011158487277275",
"304197330181340102458894783057954339787",
"93214540177594444906051492912543926126",
"229719616580827340883150016063601463139",
"1116079169046935464483898028063167908",
"179707877475520199201259944704476963255",
"156261536345107652362924349752541376952",
"323305606234630414280061400136887174894",
"269641696223797824104137154422300274051",
"45626868918861249996839155811922354794",
"148559629402009255648760956588614658158",
"16537974276516467229010094575779824734",
"217316264596944149682871359500987344654",
"304428554886377331385924044876703443175",
"174204708076407221909548189426200278855",
"98643044313704146644431276130602401824",
"100301250077684177536773056645678580846"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38666-62e9bef0",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82d19a70ced28b17a38ebf1b6978c6c7db894979",
"target": {
"file": "net/appletalk/aarp.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"73854990650700581868678392597181926646",
"263303934906244969492656116273746606367",
"200884772068156373394057522350610049293",
"163084269581594057276739236106591127978",
"216495261570935422834873764371186102979",
"279397528589569221729858028047705484060",
"180027262036980093018403653948546520078",
"129404743141437446170204429883748330787",
"319669574524256283827147139203221193288",
"97978373482137096330915800241991792561",
"72474082752636521865967004360336809646",
"240119635759487087803777011158487277275",
"304197330181340102458894783057954339787",
"93214540177594444906051492912543926126",
"229719616580827340883150016063601463139",
"1116079169046935464483898028063167908",
"179707877475520199201259944704476963255",
"156261536345107652362924349752541376952",
"323305606234630414280061400136887174894",
"269641696223797824104137154422300274051",
"45626868918861249996839155811922354794",
"148559629402009255648760956588614658158",
"16537974276516467229010094575779824734",
"217316264596944149682871359500987344654",
"304428554886377331385924044876703443175",
"174204708076407221909548189426200278855",
"98643044313704146644431276130602401824",
"100301250077684177536773056645678580846"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38666-66db2401",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82d19a70ced28b17a38ebf1b6978c6c7db894979",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_alloc"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 157.0,
"function_hash": "273577078198146005587710424504775957257"
}
},
{
"id": "CVE-2025-38666-6a6e2eb4",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@186942d19c0222617ef61f50e1dba91e269a5963",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_proxy_probe_network"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1001.0,
"function_hash": "14660294563874566865754199465454365850"
}
},
{
"id": "CVE-2025-38666-6f2e1bdb",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f02ea0f63dd38c41539ea290fcc1693c73aa8e5",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_proxy_probe_network"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1001.0,
"function_hash": "14660294563874566865754199465454365850"
}
},
{
"id": "CVE-2025-38666-7a36c78d",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c4a92d07b0850342d3becf2e608f805e972467c",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_proxy_probe_network"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1001.0,
"function_hash": "14660294563874566865754199465454365850"
}
},
{
"id": "CVE-2025-38666-801bf165",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@186942d19c0222617ef61f50e1dba91e269a5963",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_alloc"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 157.0,
"function_hash": "273577078198146005587710424504775957257"
}
},
{
"id": "CVE-2025-38666-8692f6e9",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c4a92d07b0850342d3becf2e608f805e972467c",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_alloc"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 157.0,
"function_hash": "273577078198146005587710424504775957257"
}
},
{
"id": "CVE-2025-38666-89b96b23",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4f1564c5b699eb89b3040688fd6b4e57922f1f6",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_alloc"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 157.0,
"function_hash": "273577078198146005587710424504775957257"
}
},
{
"id": "CVE-2025-38666-9133da3e",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b35694ffabb2af308a1f725d70f60fd8a47d1f3e",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_proxy_probe_network"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1001.0,
"function_hash": "14660294563874566865754199465454365850"
}
},
{
"id": "CVE-2025-38666-a0aa64c2",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f02ea0f63dd38c41539ea290fcc1693c73aa8e5",
"target": {
"file": "net/appletalk/aarp.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"73854990650700581868678392597181926646",
"263303934906244969492656116273746606367",
"200884772068156373394057522350610049293",
"163084269581594057276739236106591127978",
"216495261570935422834873764371186102979",
"279397528589569221729858028047705484060",
"180027262036980093018403653948546520078",
"129404743141437446170204429883748330787",
"319669574524256283827147139203221193288",
"97978373482137096330915800241991792561",
"72474082752636521865967004360336809646",
"240119635759487087803777011158487277275",
"304197330181340102458894783057954339787",
"93214540177594444906051492912543926126",
"229719616580827340883150016063601463139",
"1116079169046935464483898028063167908",
"179707877475520199201259944704476963255",
"156261536345107652362924349752541376952",
"323305606234630414280061400136887174894",
"269641696223797824104137154422300274051",
"45626868918861249996839155811922354794",
"148559629402009255648760956588614658158",
"16537974276516467229010094575779824734",
"217316264596944149682871359500987344654",
"304428554886377331385924044876703443175",
"174204708076407221909548189426200278855",
"98643044313704146644431276130602401824",
"100301250077684177536773056645678580846"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38666-d4295517",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f90b6bb203f3f38bf2b3d976113d51571df9a482",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_proxy_probe_network"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1001.0,
"function_hash": "14660294563874566865754199465454365850"
}
},
{
"id": "CVE-2025-38666-dfcd023b",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f90b6bb203f3f38bf2b3d976113d51571df9a482",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_alloc"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 157.0,
"function_hash": "273577078198146005587710424504775957257"
}
},
{
"id": "CVE-2025-38666-e48b2972",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4f1564c5b699eb89b3040688fd6b4e57922f1f6",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_proxy_probe_network"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1001.0,
"function_hash": "14660294563874566865754199465454365850"
}
},
{
"id": "CVE-2025-38666-ea4f9225",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b35694ffabb2af308a1f725d70f60fd8a47d1f3e",
"target": {
"file": "net/appletalk/aarp.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"73854990650700581868678392597181926646",
"263303934906244969492656116273746606367",
"200884772068156373394057522350610049293",
"163084269581594057276739236106591127978",
"216495261570935422834873764371186102979",
"279397528589569221729858028047705484060",
"180027262036980093018403653948546520078",
"129404743141437446170204429883748330787",
"319669574524256283827147139203221193288",
"97978373482137096330915800241991792561",
"72474082752636521865967004360336809646",
"240119635759487087803777011158487277275",
"304197330181340102458894783057954339787",
"93214540177594444906051492912543926126",
"229719616580827340883150016063601463139",
"1116079169046935464483898028063167908",
"179707877475520199201259944704476963255",
"156261536345107652362924349752541376952",
"323305606234630414280061400136887174894",
"269641696223797824104137154422300274051",
"45626868918861249996839155811922354794",
"148559629402009255648760956588614658158",
"16537974276516467229010094575779824734",
"217316264596944149682871359500987344654",
"304428554886377331385924044876703443175",
"174204708076407221909548189426200278855",
"98643044313704146644431276130602401824",
"100301250077684177536773056645678580846"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38666-ee897315",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4f1564c5b699eb89b3040688fd6b4e57922f1f6",
"target": {
"file": "net/appletalk/aarp.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"73854990650700581868678392597181926646",
"263303934906244969492656116273746606367",
"200884772068156373394057522350610049293",
"163084269581594057276739236106591127978",
"216495261570935422834873764371186102979",
"279397528589569221729858028047705484060",
"180027262036980093018403653948546520078",
"129404743141437446170204429883748330787",
"319669574524256283827147139203221193288",
"97978373482137096330915800241991792561",
"72474082752636521865967004360336809646",
"240119635759487087803777011158487277275",
"304197330181340102458894783057954339787",
"93214540177594444906051492912543926126",
"229719616580827340883150016063601463139",
"1116079169046935464483898028063167908",
"179707877475520199201259944704476963255",
"156261536345107652362924349752541376952",
"323305606234630414280061400136887174894",
"269641696223797824104137154422300274051",
"45626868918861249996839155811922354794",
"148559629402009255648760956588614658158",
"16537974276516467229010094575779824734",
"217316264596944149682871359500987344654",
"304428554886377331385924044876703443175",
"174204708076407221909548189426200278855",
"98643044313704146644431276130602401824",
"100301250077684177536773056645678580846"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38666-fd3f6ae5",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b35694ffabb2af308a1f725d70f60fd8a47d1f3e",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_alloc"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 157.0,
"function_hash": "273577078198146005587710424504775957257"
}
}
]