CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
In the Linux kernel, the following vulnerability has been resolved:
proc: use the same treatment to check proclseek as ones for procreaditer et.al
Check pde->procops->proclseek directly may cause UAF in rmmod scenario. It's a gap in procregopen() after commit 654b33ada4ab("proc: fix UAF in procgetinode()"). Followed by AI Viro's suggestion, fix it in same manner.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch commit 654b33ada4ab
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38653?
CVE-2025-38653 has a medium severity level due to its potential to cause a use-after-free condition during module removal.
How do I fix CVE-2025-38653?
To fix CVE-2025-38653, you should update your Linux kernel to the latest stable release that includes the vulnerability patch.
What systems are affected by CVE-2025-38653?
CVE-2025-38653 affects the Linux kernel across various distributions that utilize this code.
What vulnerabilities does CVE-2025-38653 expose?
CVE-2025-38653 exposes a vulnerability that could lead to a use-after-free condition in the Linux kernel PROC file system.
What are the potential impacts of CVE-2025-38653?
The potential impacts of CVE-2025-38653 include system crashes or exploitation which could lead to unauthorized access or execution of arbitrary code.