CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU
In the Linux kernel, the following vulnerability has been resolved:
ipc: fix to protect IPCS lookups using RCU
syzbot reported that it discovered a use-after-free vulnerability, [0]
[0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/
idrforeach() is protected by rwsem, but this is not enough. If it is not protected by RCU read-critical region, when idrforeach() calls radixtreenodefree() through callrcu() to free the radixtreenode structure, the node will be freed immediately, and when reading the next node in radixtreeforeachslot(), the already freed memory may be read.
Therefore, we need to add code to make sure that idrforeach() is protected within the RCU read-critical region when we call it in shmdestroyorphaned().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Protect the idr_for_each() call in shm_destroy_orphaned() within an RCU read-critical region to prevent radix_tree_node use-after-free during IPCS lookups.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38212?
CVE-2025-38212 is classified as a high-severity vulnerability due to its potential for causing use-after-free errors.
How do I fix CVE-2025-38212?
To fix CVE-2025-38212, update your Linux kernel to the latest stable version that addresses the vulnerability.
What are the potential impacts of CVE-2025-38212?
The potential impacts of CVE-2025-38212 include information disclosure and system compromise due to the use-after-free vulnerability.
Which versions of the Linux kernel are affected by CVE-2025-38212?
CVE-2025-38212 affects multiple versions of the Linux kernel prior to the release of the patch.
How can I determine if my system is vulnerable to CVE-2025-38212?
You can determine if your system is vulnerable to CVE-2025-38212 by checking your Linux kernel version against the patched releases.