# CVE-2025-38154: bpf, sockmap: Avoid using sk_socket after free when sending > A race condition in the Linux kernel BPF sockmap allows a use-after-free of sk_socket, leading to a kernel panic and denial of service. - **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`) - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Local or same network only - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 3 Jul 2025 - **Updated:** 15 Oct 2026 - **Also known as:** BELL-CVE-2025-38154, DEBIAN-CVE-2025-38154, GHSA-vvj3-j4jg-68hm, RHSA-2026:3520, ROOT-OS-DEBIAN-12-CVE-2025-38154, ROOT-OS-UBUNTU-2204-CVE-2025-38154, ROOT-OS-UBUNTU-2404-CVE-2025-38154, UBUNTU-CVE-2025-38154 ## What is CVE-2025-38154? CVE-2025-38154 is a high-severity use after free vulnerability in Debian Debian Linux, published on 3 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim. ### Official description In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Avoid using sk_socket after free when sending The sk->sk_socket is not locked or referenced in backlog thread, and during the call to skb_send_sock(), there is a race condition with the release of sk_socket. All types of sockets(tcp/udp/unix/vsock) will be affected. Race conditions: ''' CPU0 CPU1 backlog::skb_send_sock sendmsg_unlocked sock_sendmsg sock_sendmsg_nosec close(fd): ... ops->release() -> sock_map_close() sk_socket->ops = NULL free(socket) sock->ops->sendmsg ^ panic here ''' The ref of psock become 0 after sock_map_close() executed. ''' void sock_map_close() { ... if (likely(psock)) { ... // !! here we remove psock and the ref of psock become 0 sock_map_remove_links(sk, psock) psock = sk_psock_get(sk); if (unlikely(!psock)) goto no_psock; <=== Control jumps here via goto ... cancel_delayed_work_sync(&psock->work); <=== not executed sk_psock_put(sk, psock); ... } ''' Based on the fact that we already wait for the workqueue to finish in sock_map_close() if psock is held, we simply increase the psock reference count to avoid race conditions. With this patch, if the backlog thread is running, sock_map_close() will wait for the backlog thread to complete and cancel all pending work. If no backlog running, any pending work that hasn't started by then will fail when invoked by sk_psock_get(), as the psock reference count have been zeroed, and sk_psock_drop() will cancel all jobs via cancel_delayed_work_sync(). In summary, we require synchronization to coordinate the backlog thread and close() thread. The panic I catched: ''' Workqueue: events sk_psock_backlog RIP: 0010:sock_sendmsg+0x21d/0x440 RAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001 ... Call Trace: ? die_addr+0x40/0xa0 ? exc_general_protection+0x14c/0x230 ? asm_exc_general_protection+0x26/0x30 ? sock_sendmsg+0x21d/0x440 ? sock_sendmsg+0x3e0/0x440 ? __pfx_sock_sendmsg+0x10/0x10 __skb_send_sock+0x543/0xb70 sk_psock_backlog+0x247/0xb80 ... ''' Weakness: CWE-416 (Use After Free) ## Which versions are affected by CVE-2025-38154? It affects 2 products. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `kernel-64k-debug-debuginfo` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-64k-debug-devel` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-64k-debug-devel-matched` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-64k-debuginfo` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-64k-devel` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-64k-devel-matched` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-debug-debuginfo` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-debug-devel` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-debug-devel-matched` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-debuginfo` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-debuginfo-common-aarch64` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-debuginfo-common-ppc64le` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-debuginfo-common-s390x` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-debuginfo-common-x86_64` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-devel` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-devel-matched` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-doc` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-rt-64k-debug-debuginfo` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-rt-64k-debuginfo` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-rt-debug-debuginfo` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-rt-debuginfo` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-tools-debuginfo` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-zfcpdump-debuginfo` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-zfcpdump-devel` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-zfcpdump-devel-matched` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `libperf-debuginfo` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `perf` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `perf-debuginfo` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `python3-perf` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `python3-perf-debuginfo` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `rtla` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `rv` | Red Hat:rhel_eus:9.6::appstream | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel` | Red Hat:rhel_eus:9.6::baseos | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-64k` | Red Hat:rhel_eus:9.6::baseos | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-64k-core` | Red Hat:rhel_eus:9.6::baseos | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-64k-debug` | Red Hat:rhel_eus:9.6::baseos | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-64k-debug-core` | Red Hat:rhel_eus:9.6::baseos | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-64k-debug-debuginfo` | Red Hat:rhel_eus:9.6::baseos | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-64k-debug-modules` | Red Hat:rhel_eus:9.6::baseos | All versions | 0:5.14.0-570.94.1.el9_6 | | `kernel-64k-debug-modules-core` | Red Hat:rhel_eus:9.6::baseos | All versions | 0:5.14.0-570.94.1.el9_6 | Products: Debian Debian Linux, Linux kernel. ## How do I fix CVE-2025-38154? Apply the vendor's patch. ## Is CVE-2025-38154 being exploited? There is no known exploitation of CVE-2025-38154 in the wild and no public exploit code. ## Other vulnerabilities in Debian Debian Linux - [CVE-2015-3306](https://insights.sbomify.com/CVE-2015-3306/): ProFTPD Improper Access Control (critical 10.0, exploited in the wild) - [CVE-2025-49113](https://insights.sbomify.com/CVE-2025-49113/): RoundCube Webmail Deserialization of Untrusted Data (critical 9.9, exploited in the wild) - [CVE-2026-24061](https://insights.sbomify.com/CVE-2026-24061/): GNU InetUtils Argument Injection (critical 9.8, exploited in the wild) - [CVE-2025-39682](https://insights.sbomify.com/CVE-2025-39682/): Linux Kernel Improper Check for Unusual or Exceptional Conditions (critical 9.8, exploited in the wild) - [CVE-2024-9680](https://insights.sbomify.com/CVE-2024-9680/): Mozilla Firefox Use-After-Free (critical 9.8, exploited in the wild) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2025-38154 and fix it if it is affected. What it is: CVE-2025-38154 is a high-severity use after free vulnerability in Debian Debian Linux, published on 3 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim. Exploitation: There is no known exploitation of CVE-2025-38154 in the wild and no public exploit code. Affected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2025-38154/ (Markdown: https://insights.sbomify.com/CVE-2025-38154/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2025-38154 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-38154 - OSV: https://osv.dev/vulnerability/CVE-2025-38154 --- From sbomify Insights: https://insights.sbomify.com/CVE-2025-38154/ Summaries are generated and may contain mistakes; the official description above is the record.