{"answers":{"affected":"It affects 2 products.","exploited":"There is no known exploitation of CVE-2025-38154 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-38154 is a high-severity use after free vulnerability in Debian Debian Linux, published on 3 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-38154 and fix it if it is affected.\n\nWhat it is: CVE-2025-38154 is a high-severity use after free vulnerability in Debian Debian Linux, published on 3 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-38154 in the wild and no public exploit code.\n\nAffected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-38154/ (Markdown: https://insights.sbomify.com/CVE-2025-38154/index.md)","id":"CVE-2025-38154","markdown":"https://insights.sbomify.com/CVE-2025-38154/index.md","name":"CVE-2025-38154","record":{"aliases":["BELL-CVE-2025-38154","DEBIAN-CVE-2025-38154","GHSA-vvj3-j4jg-68hm","RHSA-2026:3520","ROOT-OS-DEBIAN-12-CVE-2025-38154","ROOT-OS-UBUNTU-2204-CVE-2025-38154","ROOT-OS-UBUNTU-2404-CVE-2025-38154","UBUNTU-CVE-2025-38154"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A race condition in the Linux kernel BPF sockmap allows a use-after-free of sk_socket, leading to a kernel panic and denial of service.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"debian_linux","vendor":"debian"},{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Avoid using sk_socket after free when sending\n\nThe sk-\u003esk_socket is not locked or referenced in backlog thread, and\nduring the call to skb_send_sock(), there is a race condition with\nthe release of sk_socket. All types of sockets(tcp/udp/unix/vsock)\nwill be affected.\n\nRace conditions:\n'''\nCPU0                               CPU1\n\nbacklog::skb_send_sock\n  sendmsg_unlocked\n    sock_sendmsg\n      sock_sendmsg_nosec\n                                   close(fd):\n                                     ...\n                                     ops-\u003erelease() -\u003e sock_map_close()\n                                     sk_socket-\u003eops = NULL\n                                     free(socket)\n      sock-\u003eops-\u003esendmsg\n            ^\n            panic here\n'''\n\nThe ref of psock become 0 after sock_map_close() executed.\n'''\nvoid sock_map_close()\n{\n    ...\n    if (likely(psock)) {\n    ...\n    // !! here we remove psock and the ref of psock become 0\n    sock_map_remove_links(sk, psock)\n    psock = sk_psock_get(sk);\n    if (unlikely(!psock))\n        goto no_psock; \u003c=== Control jumps here via goto\n        ...\n        cancel_delayed_work_sync(\u0026psock-\u003ework); \u003c=== not executed\n        sk_psock_put(sk, psock);\n        ...\n}\n'''\n\nBased on the fact that we already wait for the workqueue to finish in\nsock_map_close() if psock is held, we simply increase the psock\nreference count to avoid race conditions.\n\nWith this patch, if the backlog thread is running, sock_map_close() will\nwait for the backlog thread to complete and cancel all pending work.\n\nIf no backlog running, any pending work that hasn't started by then will\nfail when invoked by sk_psock_get(), as the psock reference count have\nbeen zeroed, and sk_psock_drop() will cancel all jobs via\ncancel_delayed_work_sync().\n\nIn summary, we require synchronization to coordinate the backlog thread\nand close() thread.\n\nThe panic I catched:\n'''\nWorkqueue: events sk_psock_backlog\nRIP: 0010:sock_sendmsg+0x21d/0x440\nRAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001\n...\nCall Trace:\n \u003cTASK\u003e\n ? die_addr+0x40/0xa0\n ? exc_general_protection+0x14c/0x230\n ? asm_exc_general_protection+0x26/0x30\n ? sock_sendmsg+0x21d/0x440\n ? sock_sendmsg+0x3e0/0x440\n ? __pfx_sock_sendmsg+0x10/0x10\n __skb_send_sock+0x543/0xb70\n sk_psock_backlog+0x247/0xb80\n...\n'''","ecosystems":["Red Hat:rhel_eus:9.6::appstream","Red Hat:rhel_eus:9.6::baseos","Red Hat:rhel_eus:9.6::crb","Red Hat:rhel_eus:9.6::nfv","Red Hat:rhel_eus:9.6::realtime"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"bpf, sockmap: Avoid using sk_socket after free when sending","id":"CVE-2025-38154","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"debian:debian_linux","products":["debian:debian_linux","linux:linux_kernel"],"type":"use_after_free","year":"2025"},"n_packages":160,"n_references":6,"next":{"headline":"wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init()","id":"CVE-2025-38155"},"packages":[{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-debuginfo","purl":"pkg:rpm/redhat/kernel-64k-debug-debuginfo","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-devel","purl":"pkg:rpm/redhat/kernel-64k-debug-devel","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-devel-matched","purl":"pkg:rpm/redhat/kernel-64k-debug-devel-matched","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debuginfo","purl":"pkg:rpm/redhat/kernel-64k-debuginfo","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-devel","purl":"pkg:rpm/redhat/kernel-64k-devel","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-devel-matched","purl":"pkg:rpm/redhat/kernel-64k-devel-matched","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-debuginfo","purl":"pkg:rpm/redhat/kernel-debug-debuginfo","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-devel","purl":"pkg:rpm/redhat/kernel-debug-devel","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-devel-matched","purl":"pkg:rpm/redhat/kernel-debug-devel-matched","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo","purl":"pkg:rpm/redhat/kernel-debuginfo","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-aarch64","purl":"pkg:rpm/redhat/kernel-debuginfo-common-aarch64","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-ppc64le","purl":"pkg:rpm/redhat/kernel-debuginfo-common-ppc64le","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-s390x","purl":"pkg:rpm/redhat/kernel-debuginfo-common-s390x","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-x86_64","purl":"pkg:rpm/redhat/kernel-debuginfo-common-x86_64","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-devel","purl":"pkg:rpm/redhat/kernel-devel","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-devel-matched","purl":"pkg:rpm/redhat/kernel-devel-matched","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-doc","purl":"pkg:rpm/redhat/kernel-doc","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-rt-64k-debug-debuginfo","purl":"pkg:rpm/redhat/kernel-rt-64k-debug-debuginfo","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-rt-64k-debuginfo","purl":"pkg:rpm/redhat/kernel-rt-64k-debuginfo","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-rt-debug-debuginfo","purl":"pkg:rpm/redhat/kernel-rt-debug-debuginfo","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-rt-debuginfo","purl":"pkg:rpm/redhat/kernel-rt-debuginfo","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-tools-debuginfo","purl":"pkg:rpm/redhat/kernel-tools-debuginfo","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-zfcpdump-debuginfo","purl":"pkg:rpm/redhat/kernel-zfcpdump-debuginfo","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-zfcpdump-devel","purl":"pkg:rpm/redhat/kernel-zfcpdump-devel","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-zfcpdump-devel-matched","purl":"pkg:rpm/redhat/kernel-zfcpdump-devel-matched","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"libperf-debuginfo","purl":"pkg:rpm/redhat/libperf-debuginfo","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"perf","purl":"pkg:rpm/redhat/perf","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"perf-debuginfo","purl":"pkg:rpm/redhat/perf-debuginfo","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"python3-perf","purl":"pkg:rpm/redhat/python3-perf","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"python3-perf-debuginfo","purl":"pkg:rpm/redhat/python3-perf-debuginfo","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"rtla","purl":"pkg:rpm/redhat/rtla","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"rv","purl":"pkg:rpm/redhat/rv","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel","purl":"pkg:rpm/redhat/kernel","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-64k","purl":"pkg:rpm/redhat/kernel-64k","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-core","purl":"pkg:rpm/redhat/kernel-64k-core","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug","purl":"pkg:rpm/redhat/kernel-64k-debug","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-core","purl":"pkg:rpm/redhat/kernel-64k-debug-core","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-debuginfo","purl":"pkg:rpm/redhat/kernel-64k-debug-debuginfo","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-modules","purl":"pkg:rpm/redhat/kernel-64k-debug-modules","source":"RHSA-2026:3520"},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","fixed":["0:5.14.0-570.94.1.el9_6"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-modules-core","purl":"pkg:rpm/redhat/kernel-64k-debug-modules-core","source":"RHSA-2026:3520"}],"prev":{"headline":"net: usb: aqc111: fix error handling of usbnet read calls","id":"CVE-2025-38153"},"products":["Linux"],"published":"2025-07-03","related":[{"cvss_score":10,"headline":"ProFTPD Improper Access Control","id":"CVE-2015-3306","kev_date_added":"2026-10-08","published":"2015-05-18"},{"cvss_score":9.9,"headline":"RoundCube Webmail Deserialization of Untrusted Data","id":"CVE-2025-49113","kev_date_added":"2026-02-20","published":"2025-06-02"},{"cvss_score":9.8,"headline":"GNU InetUtils Argument Injection","id":"CVE-2026-24061","kev_date_added":"2026-01-26","published":"2026-01-21"},{"cvss_score":9.8,"headline":"Linux Kernel Improper Check for Unusual or Exceptional Conditions","id":"CVE-2025-39682","kev_date_added":"2026-09-18","published":"2025-09-05"},{"cvss_score":9.8,"headline":"Mozilla Firefox Use-After-Free","id":"CVE-2024-9680","kev_date_added":"2024-10-15","published":"2024-10-09"},{"cvss_score":9.8,"headline":"RARLAB UnRAR Directory Traversal","id":"CVE-2022-30333","kev_date_added":"2022-08-09","published":"2022-05-09"},{"cvss_score":9.8,"headline":"Roundcube Webmail SQL Injection","id":"CVE-2021-44026","kev_date_added":"2023-06-22","published":"2021-11-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-15","vendors":["Linux"]},"summary":"A race condition in the Linux kernel BPF sockmap allows a use-after-free of sk_socket, leading to a kernel panic and denial of service.","url":"https://insights.sbomify.com/CVE-2025-38154/"}