UBUNTU-CVE-2025-38236: Use After Free

Q: What access does an attacker need to exploit this issue?

An attacker needs local access and low privileges. Exploitation involves creating a UNIX stream socket pair and sending and receiving out-of-band data in a specific sequence; no user interaction is required.

Q: Which Ubuntu kernel packages are identified as affected?

The affected software list includes ubuntu/linux-azure-fde, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-gke, ubuntu/linux-gkeop, ubuntu/linux-riscv, and ubuntu/linux-aws-fips.

Q: What runtime behavior could indicate an attempted or successful trigger?

The described sequence can trigger a use-after-free when a normal receive follows multiple consumed MSG_OOB receives and is followed by another MSG_OOB receive. On systems using KASAN, the final out-of-band receive is described as producing a KASAN splat.

Published Jul 8, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: afunix: Don't leave consecutive consumed OOB skbs. Jann Horn reported a use-after-free in unixstreamreadgeneric(). The following sequences reproduce the issue: $ python3 from socket import s1, s2 = socketpair(AFUNIX, SOCKSTREAM) s1.send(b'x', MSGOOB) s2.recv(1, MSGOOB) # leave a consumed OOB skb s1.send(b'y', MSGOOB) s2.recv(1, MSGOOB) # leave a consumed OOB skb s1.send(b'z', MSGOOB) s2.recv(1) # recv 'z' illegally s2.recv(1, MSGOOB) # access 'z' skb (use-after-free) Even though a user reads OOB data, the skb holding the data stays on the recv queue to mark the OOB boundary and break the next recv(). After the last send() in the scenario above, the sk2's recv queue has 2 leading consumed OOB skbs and 1 real OOB skb. Then, the following happens during the next recv() without MSGOOB 1. unixstreamreadgeneric() peeks the first consumed OOB skb 2. manageoob() returns the next consumed OOB skb 3. unixstreamreadgeneric() fetches the next not-yet-consumed OOB skb 4. unixstreamreadgeneric() reads and frees the OOB skb , and the last recv(MSGOOB) triggers KASAN splat. The 3. above occurs because of the SOPEEKOFF code, which does not expect unixskblen(skb) to be 0, but this is true for such consumed OOB skbs. while (skip >= unixskblen(skb)) { skip -= unixskblen(skb); skb = skbpeeknext(skb, &sk->skreceivequeue); ... } In addition to this use-after-free, there is another issue that ioctl(SIOCATMARK) does not function properly with consecutive consumed OOB skbs. So, nothing good comes out of such a situation. Instead of complicating manageoob(), ioctl() handling, and the next ECONNRESET fix by introducing a loop for consecutive consumed OOB skbs, let's not leave such consecutive OOB unnecessarily. Now, while receiving an OOB skb in unixstreamrecvurg(), if its previous skb is a consumed OOB skb, it is freed. [0]: BUG: KASAN: slab-use-after-free in unixstreamreadactor (net/unix/afunix.c:3027) Read of size 4 at addr ffff888106ef2904 by task python3/315 CPU: 2 UID: 0 PID: 315 Comm: python3 Not tainted 6.16.0-rc1-00407-gec315832f6f9 #8 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-4.fc42 04/01/2014 Call Trace: <TASK> dumpstacklvl (lib/dumpstack.c:122) printreport (mm/kasan/report.c:409 mm/kasan/report.c:521) kasanreport (mm/kasan/report.c:636) unixstreamreadactor (net/unix/afunix.c:3027) unixstreamreadgeneric (net/unix/afunix.c:2708 net/unix/afunix.c:2847) unixstreamrecvmsg (net/unix/afunix.c:3048) sockrecvmsg (net/socket.c:1063 (discriminator 20) net/socket.c:1085 (discriminator 20)) sysrecvfrom (net/socket.c:2278) x64sysrecvfrom (net/socket.c:2291 (discriminator 1) net/socket.c:2287 (discriminator 1) net/socket.c:2287 (discriminator 1)) dosyscall64 (arch/x86/entry/syscall64.c:63 (discriminator 1) arch/x86/entry/syscall64.c:94 (discriminator 1)) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:130) RIP: 0033:0x7f8911fcea06 Code: 5d e8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 75 19 83 e2 39 83 fa 08 75 11 e8 26 ff ff ff 66 0f 1f 44 00 00 48 8b 45 10 0f 05 <48> 8b 5d f8 c9 c3 0f 1f 40 00 f3 0f 1e fa 55 48 89 e5 48 83 ec 08 RSP: 002b:00007fffdb0dccb0 EFLAGS: 00000202 ORIGRAX: 000000000000002d RAX: ffffffffffffffda RBX: 00007fffdb0dcdc8 RCX: 00007f8911fcea06 RDX: 0000000000000001 RSI: 00007f8911a5e060 RDI: 0000000000000006 RBP: 00007fffdb0dccd0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000202 R12: 00007f89119a7d20 R13: ffffffffc4653600 R14: 0000000000000000 R15: 0000000000000000 </TASK> Allocated by task 315: kasansavestack (mm/kasan/common.c:48) kasansavetrack (mm/kasan/common.c:60 (discriminator 1) mm/kasan/common.c:69 (discriminator 1)) kasanslaballoc (mm/kasan/common.c:348) kmemcachealloc ---truncated---

Affected Software

170 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15<5.15.0-1100.107~20.04.2

5.15.0-1100.107~20.04.2

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15<5.15.0-1110.119~20.04.1

5.15.0-1110.119~20.04.1

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15<5.15.0-1100.109~20.04.1

5.15.0-1100.109~20.04.1

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15<5.15.0-170.180~20.04.3

5.15.0-170.180~20.04.3

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm-5.15<5.15.0-1094.97~20.04.1

5.15.0-1094.97~20.04.1

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15<5.15.0-1095.101~20.04.1

5.15.0-1095.101~20.04.1

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-170.180~20.04.1

5.15.0-170.180~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1052.52~20.04.2

5.15.0-1052.52~20.04.2

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15<5.15.0-1097.103~20.04.1

5.15.0-1097.103~20.04.1

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15<5.15.0-1095.99~20.04.1

5.15.0-1095.99~20.04.1

ubuntu/linux-riscv-5.8*

ubuntu/linux<5.15.0-170.180

5.15.0-170.180

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1100.107

5.15.0-1100.107

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1046.49~22.04.1

6.8.0-1046.49~22.04.1

ubuntu/linux-azure<5.15.0-1109.118

5.15.0-1109.118

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1051.57~22.04.1

6.8.0-1051.57~22.04.1

ubuntu/linux-azure-fde<5.15.0-1109.118.1

5.15.0-1109.118.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1046.53~22.04.1

6.8.0-1046.53~22.04.1

ubuntu/linux-gcp<5.15.0-1100.109

5.15.0-1100.109

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1047.50~22.04.2

6.8.0-1047.50~22.04.2

ubuntu/linux-gke<5.15.0-1096.102

5.15.0-1096.102

ubuntu/linux-gkeop<5.15.0-1083.91

5.15.0-1083.91

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-100.100~22.04.1

6.8.0-100.100~22.04.1

ubuntu/linux-ibm<5.15.0-1094.97

5.15.0-1094.97

ubuntu/linux-ibm-6.8<6.8.0-1044.44~22.04.1

6.8.0-1044.44~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1095.101

5.15.0-1095.101

ubuntu/linux-kvm<5.15.0-1092.97

5.15.0-1092.97

ubuntu/linux-lowlatency<5.15.0-170.180

5.15.0-170.180

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-100.100.1~22.04.1

6.8.0-100.100.1~22.04.1

ubuntu/linux-nvidia<5.15.0-1095.96

5.15.0-1095.96

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1046.49~22.04.1

6.8.0-1046.49~22.04.1

ubuntu/linux-nvidia-tegra<5.15.0-1052.52

5.15.0-1052.52

ubuntu/linux-nvidia-tegra-igx<5.15.0-1041.41

5.15.0-1041.41

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1097.103

5.15.0-1097.103

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1043.44~22.04.1

6.8.0-1043.44~22.04.1

ubuntu/linux-raspi<5.15.0-1097.100

5.15.0-1097.100

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-100.100~22.04.1

6.8.0-100.100~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1064.68

5.15.0-1064.68

ubuntu/linux-bluefield<5.15.0-1084.86

5.15.0-1084.86

ubuntu/linux-intel-iot-realtime<5.15.0-1092.94

5.15.0-1092.94

ubuntu/linux-realtime<5.15.0-1099.108

5.15.0-1099.108

ubuntu/linux-realtime-6.8<6.8.1-1041.42~22.04.1

6.8.1-1041.42~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1100.107+fips1

5.15.0-1100.107+fips1

ubuntu/linux-azure-fips<5.15.0-1109.118+fips1

5.15.0-1109.118+fips1

ubuntu/linux-fips<5.15.0-170.180+fips1

5.15.0-170.180+fips1

ubuntu/linux-gcp-fips<5.15.0-1100.109+fips1

5.15.0-1100.109+fips1

ubuntu/linux<6.8.0-100.100

6.8.0-100.100

ubuntu/linux-aws<6.8.0-1046.49

6.8.0-1046.49

ubuntu/linux-aws-6.14<6.14.0-1015.15~24.04.1

6.14.0-1015.15~24.04.1

ubuntu/linux-azure<6.8.0-1046.52

6.8.0-1046.52

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14<6.14.0-1014.14~24.04.1

6.14.0-1014.14~24.04.1

ubuntu/linux-azure-fde<6.8.0-1046.53

6.8.0-1046.53

ubuntu/linux-azure-nvidia<6.8.0-1039.42

6.8.0-1039.42

ubuntu/linux-azure-nvidia-6.14<6.14.0-1007.7

6.14.0-1007.7

ubuntu/linux-gcp<6.8.0-1047.50

6.8.0-1047.50

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14<6.14.0-1018.19~24.04.1

6.14.0-1018.19~24.04.1

ubuntu/linux-gke<6.8.0-1043.48

6.8.0-1043.48

ubuntu/linux-gkeop<6.8.0-1030.33

6.8.0-1030.33

ubuntu/linux-hwe-6.11*

ubuntu/linux-ibm<6.8.0-1044.44

6.8.0-1044.44

ubuntu/linux-intel*

ubuntu/linux-lowlatency<6.8.0-100.100.1

6.8.0-100.100.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1046.49

6.8.0-1046.49

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-lowlatency<6.8.0-1046.49.1

6.8.0-1046.49.1

ubuntu/linux-nvidia-tegra<6.8.0-1020.20

6.8.0-1020.20

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14<6.14.0-1014.14

6.14.0-1014.14

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1043.44

6.8.0-1043.44

ubuntu/linux-oracle-6.14<6.14.0-1015.15~24.04.1

6.14.0-1015.15~24.04.1

ubuntu/linux-raspi<6.8.0-1047.51

6.8.0-1047.51

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14<6.14.0-34.34.1~24.04.1

6.14.0-34.34.1~24.04.1

ubuntu/linux-xilinx<6.8.0-1023.24

6.8.0-1023.24

ubuntu/linux-bluefield<6.8.0-1016.20

6.8.0-1016.20

ubuntu/linux-raspi-realtime<6.8.0-2037.38

6.8.0-2037.38

ubuntu/linux-realtime<6.8.1-1041.42

6.8.1-1041.42

ubuntu/linux-realtime-6.14<6.14.0-1014.14~24.04.1

6.14.0-1014.14~24.04.1

ubuntu/linux-aws-fips<6.8.0-1046.49+fips1

6.8.0-1046.49+fips1

ubuntu/linux-azure-fips<6.8.0-1046.52+fips1

6.8.0-1046.52+fips1

ubuntu/linux-fips<6.8.0-100.100+fips1

6.8.0-100.100+fips1

ubuntu/linux-gcp-fips<6.8.0-1047.50+fips1

6.8.0-1047.50+fips1

ubuntu/linux-azure-fde*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1100.107~20.04.2
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1110.119~20.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1100.109~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-170.180~20.04.3
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1094.97~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1095.101~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-170.180~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1052.52~20.04.2
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1097.103~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1095.99~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-170.180
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1100.107
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49~22.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1109.118
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.57~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1109.118.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.53~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1100.109
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.50~22.04.2
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1096.102
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1083.91
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1094.97
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.44~22.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1095.101
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.97
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-170.180
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1095.96
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1052.52
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1041.41
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1097.103
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.44~22.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1097.100
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100~22.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1064.68
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1084.86
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.94
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1099.108
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1041.42~22.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1100.107+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1109.118+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-170.180+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1100.109+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49
Upgrade
Upgrade ubuntu/linux-aws-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1015.15~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.52
Upgrade
Upgrade ubuntu/linux-azure-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.53
Upgrade
Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1039.42
Upgrade
Upgrade ubuntu/linux-azure-nvidia-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1007.7
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.50
Upgrade
Upgrade ubuntu/linux-gcp-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1018.19~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.48
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1030.33
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.44
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1020.20
Upgrade
Upgrade ubuntu/linux-oem-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1014.14
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.44
Upgrade
Upgrade ubuntu/linux-oracle-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1015.15~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.51
Upgrade
Upgrade ubuntu/linux-riscv-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-34.34.1~24.04.1
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1023.24
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1016.20
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2037.38
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1041.42
Upgrade
Upgrade ubuntu/linux-realtime-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.49+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.52+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-100.100+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1047.50+fips1

Event History

Jul 8, 2025

CVE Published

via OSV·08:15 AM

Data Sourced

via OSV·08:15 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

An attacker needs local access and low privileges. Exploitation involves creating a UNIX stream socket pair and sending and receiving out-of-band data in a specific sequence; no user interaction is required.

Which Ubuntu kernel packages are identified as affected?

The affected software list includes ubuntu/linux-azure-fde, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-gke, ubuntu/linux-gkeop, ubuntu/linux-riscv, and ubuntu/linux-aws-fips.

What runtime behavior could indicate an attempted or successful trigger?

The described sequence can trigger a use-after-free when a normal receive follows multiple consumed MSG_OOB receives and is followed by another MSG_OOB receive. On systems using KASAN, the final out-of-band receive is described as producing a KASAN splat.

UBUNTU-CVE-2025-38236: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which Ubuntu kernel packages are identified as affected?

What runtime behavior could indicate an attempted or successful trigger?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which Ubuntu kernel packages are identified as affected?

What runtime behavior could indicate an attempted or successful trigger?