CVE-2025-38500

A flaw was found in the Linux kernel's IPsec packet transformation (xfrm) interface. A local user with network administration privileges can exploit this flaw to cause a Denial of Service (DoS) by crashing the system. This vulnerability occurs due to improper state validation when modifying metadata-collecting interfaces, leading to memory being freed twice during network namespace cleanup.

A logic error in xfrmi_changelink() allowed the special collect_md xfrm interface to be (re)added to the regular hash, causing it to be tracked twice and freed twice when the net namespace is destroyed. This results in a use-after-free/double-free and a kernel BUG in unregister_netdevice_many_notify(), i.e., a DoS. Exploitation requires CAP_NET_ADMIN to modify xfrm interfaces.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.