CVE-2025-38236

A use-after-free flaw was found in the Linux kernel's AF_UNIX sockets functionality in how a user triggers the issue by sending and receiving a crafted sequence of OOB socket messages. This vulnerability allows a local attacker to escalate privileges, especially if the kernel address layout information, such as kernel address space layout randomization  (KASLR), is exposed through freed memory.

This patch addresses a use-after-free vulnerability in the af_unix subsystem, specifically when handling consecutive out-of-band (OOB) messages. Improper management of consumed OOB sk_buffs could lead to a dangling pointer being accessed after it was freed, potentially causing memory corruption or privilege escalation. An unprivileged local attacker can trigger the bug by sending and receiving a crafted sequence of OOB socket messages via AF_UNIX stream sockets. This may allow kernel memory manipulation from user space, leading to possible code execution or system compromise. Although the exploit can be carried out by an unprivileged user-space process using crafted AF_UNIX socket operations via send(MSG_OOB) and recv(MSG_OOB)), the attacker still needs local code execution access, but no elevated privileges are required. For the Red Hat Enterprise Linux 8 bug not yet introduced, related source code is not backported to any version, but for Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 it is actual. The CVSS the Availability is Low because kernel panic likely would not happen until KASAN is enabled with additional debugging. The impact level is Important. A local attacker might leverage this issue to escalate privileges, especially if kernel address layout information, such as KASLR, is exposed through the freed memory.

No Red Hat Enterprise Linux is affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.