CVE-2025-38273

In the Linux kernel, the following vulnerability has been resolved:

net: tipc: fix refcount warning in tipc_aead_encrypt

syzbot reported a refcount warning 1 ↗ caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup.

The recently added get_net() call in commit e279024617134 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to hold a reference to the network namespace. However, if the namespace is already being destroyed, its refcount might be zero, leading to the use-after-free warning.

Replace get_net() with maybe_get_net(), which safely checks if the refcount is non-zero before incrementing it. If the namespace is being destroyed, return -ENODEV early, after releasing the bearer reference.

This vulnerability poses minimal risk to Red Hat Enterprise Linux systems because the problematic code change introduced upstream was never included in enterprise kernel releases. In addition, the Transparent Inter-Process Communication (TIPC) module is not loaded by default in standard installations. The issue stems from a race condition during network namespace cleanup where a discovery timer attempts to reference an expiring namespace, which does not manifest in supported configurations.