CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU
Vulnerability summary
CVE-2025-38212 is a high (CVSS 7.8) Use After Free vulnerability in debian debian_linux. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.6% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 133 · Related 127Showing 100 of 133.
Timeline
- 04-07-2025PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookups using RCU syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/ idr_for_each() is protected by rwsem, but this is not enough. If it is not protected by RCU read-critical region, when idr_for_each() calls radix_tree_node_free() through call_rcu() to free the radix_tree_node structure, the node will be freed immediately, and when reading the next node in radix_tree_for_each_slot(), the already freed memory may be read. Therefore, we need to add code to make sure that idr_for_each() is protected within the RCU read-critical region when we call it in shm_destroy_orphaned().
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
10%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 0.17% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu146 products
- linuxAll versions (No fix recorded) | < 5.15.0-156.166 | < 6.8.0-100.100
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1092.99 | < 6.8.0-1046.49
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Suse9 products
- kernel-livepatch-MICRO-6-0_Update_9&distro=SUSE Linux Micro 6.0< 4-1.2
- kernel-livepatch-MICRO-6-0_Update_9&distro=SUSE Linux Micro 6.1< 4-1.2
- kernel-livepatch-SLE15-SP3_Update_59&distro=SUSE Linux Enterprise Live Patching 15 SP3< 4-150300.2.1
- kernel-livepatch-SLE15-SP4_Update_42&distro=SUSE Linux Enterprise Live Patching 15 SP4< 3-150400.2.1
- kernel-livepatch-SLE15-SP6_Update_13&distro=SUSE Linux Enterprise Live Patching 15 SP6< 3-150600.2.1
Debian2 products
- linux< 6.1.147-1 | < 6.12.35-1
- debian_linuxEOL11.0
Linux2 products
- linux≥ b34a6b1da371ed8af1221459a18c67970f7e3d53, < 5f1e1573bf103303944fd7225559de5d8297539c | ≥ b34a6b1da371ed8af1221459a18c67970f7e3d53, < b968ba8bfd9f90914957bbbd815413bf6a98eca7 | ≥ b34a6b1da371ed8af1221459a18c67970f7e3d53, < 74bc813d11c30e28fc5261dc877cca662ccfac68 | ≥ b34a6b1da371ed8af1221459a18c67970f7e3d53, < 78297d53d3878d43c1d627d20cd09f611fa4b91d | ≥ b34a6b1da371ed8af1221459a18c67970f7e3d53, < 5180561afff8e0f029073c8c8117c95c6512d1f9 | ≥ b34a6b1da371ed8af1221459a18c67970f7e3d53, < 68c173ea138b66d7dd1fd980c9bc578a18e11884 | ≥ b34a6b1da371ed8af1221459a18c67970f7e3d53, < b0b6bf90ce2699a574b3683e22c44d0dcdd7a057 | ≥ b34a6b1da371ed8af1221459a18c67970f7e3d53, < d66adabe91803ef34a8b90613c81267b5ded1472 | 3.1
- linux_kernel≥ 3.1, < 5.4.295 | ≥ 5.5, < 5.10.239 | ≥ 5.11, < 5.15.186 | ≥ 5.16, < 6.1.142 | ≥ 6.2, < 6.6.95 | ≥ 6.7, < 6.12.35 | ≥ 6.13, < 6.15.4
4 vendors · 159 products
