CVE-2025-38734
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38734
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38734.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-38734
- Downstream
- Related
- Published
- 2025-09-05T17:20:34Z
- Modified
- 2025-10-10T16:45:44.272312Z
- Summary
- net/smc: fix UAF on smcsk after smc_listen_out()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix UAF on smcsk after smclistenout()
BPF CI testing report a UAF issue:
[ 16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003 0 [ 16.447134] #PF: supervisor read access in kernel mod e [ 16.447516] #PF: errorcode(0x0000) - not-present pag e [ 16.447878] PGD 0 P4D 0 [ 16.448063] Oops: Oops: 0000 [#1] PREEMPT SMP NOPT I [ 16.448409] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Tainted: G OE 6.13.0-rc3-g89e8a75fda73-dirty #4 2 [ 16.449124] Tainted: [O]=OOTMODULE, [E]=UNSIGNEDMODUL E [ 16.449502] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/201 4 [ 16.450201] Workqueue: smchswq smclistenwor k [ 16.450531] RIP: 0010:smclistenwork+0xc02/0x159 0 [ 16.452158] RSP: 0018:ffffb5ab40053d98 EFLAGS: 0001024 6 [ 16.452526] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 000000000000030 0 [ 16.452994] RDX: 0000000000000280 RSI: 00003513840053f0 RDI: 000000000000000 0 [ 16.453492] RBP: ffffa097808e3800 R08: ffffa09782dba1e0 R09: 000000000000000 5 [ 16.453987] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa0978274640 0 [ 16.454497] R13: 0000000000000000 R14: 0000000000000000 R15: ffffa09782d4092 0 [ 16.454996] FS: 0000000000000000(0000) GS:ffffa097bbc00000(0000) knlGS:000000000000000 0 [ 16.455557] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003 3 [ 16.455961] CR2: 0000000000000030 CR3: 0000000102788004 CR4: 0000000000770ef 0 [ 16.456459] PKRU: 5555555 4 [ 16.456654] Call Trace : [ 16.456832] <TASK > [ 16.456989] ? _die+0x23/0x7 0 [ 16.457215] ? pagefaultoops+0x180/0x4c 0 [ 16.457508] ? _lockacquire+0x3e6/0x249 0 [ 16.457801] ? excpagefault+0x68/0x20 0 [ 16.458080] ? asmexcpagefault+0x26/0x3 0 [ 16.458389] ? smclistenwork+0xc02/0x159 0 [ 16.458689] ? smclistenwork+0xc02/0x159 0 [ 16.458987] ? lockisheldtype+0x8f/0x10 0 [ 16.459284] processonework+0x1ea/0x6d 0 [ 16.459570] workerthread+0x1c3/0x38 0 [ 16.459839] ? _pfxworkerthread+0x10/0x1 0 [ 16.460144] kthread+0xe0/0x11 0 [ 16.460372] ? _pfxkthread+0x10/0x1 0 [ 16.460640] retfromfork+0x31/0x5 0 [ 16.460896] ? _pfxkthread+0x10/0x1 0 [ 16.461166] retfromforkasm+0x1a/0x3 0 [ 16.461453] </TASK > [ 16.461616] Modules linked in: bpftestmod(OE) [last unloaded: bpftestmod(OE) ] [ 16.462134] CR2: 000000000000003 0 [ 16.462380] ---[ end trace 0000000000000000 ]--- [ 16.462710] RIP: 0010:smclisten_work+0xc02/0x1590
The direct cause of this issue is that after smclistenout_connected(), newclcsock->sk may be NULL since it will releases the smcsk. Therefore, if the application closes the socket immediately after accept, newclcsock->sk can be NULL. A possible execution order could be as follows:
smclistenwork | userspace
locksock(sk) | smclistenoutconnected() | | - smclistenout | | | - releasesock | | |- sk->skdataready() | | fd = accept(); | close(fd); | - socket->sk = NULL; /* newclcsock->sk is NULL now */ SMCSTATSERVSUCCINC(socknet(newclcsock->sk))
Since smclistenout_connected() will not fail, simply swapping the order of the code can easily fix this issue.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/070b4af44c4b6e4c35fb1ca7001a6a88fd2d318f
- https://git.kernel.org/stable/c/2e765ba0ee0eae35688b443e97108308a716773e
- https://git.kernel.org/stable/c/85545f1525f9fa9bf44fec77ba011024f15da342
- https://git.kernel.org/stable/c/d9cef55ed49117bd63695446fb84b4b91815c0b4
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3b2dec2603d5b06ad3af71c1164ca0b92df3d2a8Fixed070b4af44c4b6e4c35fb1ca7001a6a88fd2d318f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3b2dec2603d5b06ad3af71c1164ca0b92df3d2a8Fixed2e765ba0ee0eae35688b443e97108308a716773e
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3b2dec2603d5b06ad3af71c1164ca0b92df3d2a8Fixed85545f1525f9fa9bf44fec77ba011024f15da342
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3b2dec2603d5b06ad3af71c1164ca0b92df3d2a8Fixedd9cef55ed49117bd63695446fb84b4b91815c0b4