CVE-2025-38273: net: tipc: fix refcount warning in tipc_aead_encrypt
In the Linux kernel, the following vulnerability has been resolved:
net: tipc: fix refcount warning in tipcaeadencrypt
syzbot reported a refcount warning [1] caused by calling getnet() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup.
The recently added getnet() call in commit e279024617134 ("net/tipc: fix slab-use-after-free Read in tipcaeadencryptdone") attempts to hold a reference to the network namespace. However, if the namespace is already being destroyed, its refcount might be zero, leading to the use-after-free warning.
Replace getnet() with maybegetnet(), which safely checks if the refcount is non-zero before incrementing it. If the namespace is being destroyed, return -ENODEV early, after releasing the bearer reference.
[1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38273?
CVE-2025-38273 has been categorized as a medium severity vulnerability due to the risk of refcount warnings that could lead to instability.
How do I fix CVE-2025-38273?
To fix CVE-2025-38273, update your Linux kernel to the latest stable version that contains the patch addressing this issue.
Which Linux kernel versions are affected by CVE-2025-38273?
CVE-2025-38273 affects Linux kernel versions between 5.10.238 and 6.15, along with specific later versions.
What type of vulnerability is CVE-2025-38273?
CVE-2025-38273 is a reference counting error related to the TIPC protocol in the Linux kernel.
Can CVE-2025-38273 be exploited remotely?
CVE-2025-38273 is not categorized as a remote exploit but may impact system stability if a vulnerable kernel is running.