CVE-2025-38273 (GCVE-0-2025-38273)

Vulnerability from cvelistv5 – Published: 2025-07-10 07:41 – Updated: 2026-08-05 12:00
VLAI
Title
net: tipc: fix refcount warning in tipc_aead_encrypt
Summary
In the Linux kernel, the following vulnerability has been resolved: net: tipc: fix refcount warning in tipc_aead_encrypt syzbot reported a refcount warning [1] caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup. The recently added get_net() call in commit e279024617134 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to hold a reference to the network namespace. However, if the namespace is already being destroyed, its refcount might be zero, leading to the use-after-free warning. Replace get_net() with maybe_get_net(), which safely checks if the refcount is non-zero before incrementing it. If the namespace is being destroyed, return -ENODEV early, after releasing the bearer reference. [1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d42ed4de6aba232d946d20653a70f79158a6535b , < 445d59025d76d0638b03110f8791d5b89ed5162d (git)
Affected: f5c2c4eaaa5a8e7e0685ec031d480e588e263e59 , < e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029 (git)
Affected: b8fcae6d2e93c54cacb8f579a77d827c1c643eb5 , < 307391e8fe70401a6d39ecc9978e13c2c0cdf81f (git)
Affected: b19fc1d0be3c3397e5968fe2627f22e7f84673b1 , < acab7ca5ff19889b80a8ee7dec220ee1a96dede9 (git)
Affected: 689a205cd968a1572ab561b0c4c2d50a10e9d3b0 , < c762fc79d710d676b793f9d98b1414efe6eb51e6 (git)
Affected: e279024617134c94fd3e37470156534d5f2b3472 , < 9ff60e0d9974dccf24e89bcd3ee7933e538d929f (git)
Affected: e279024617134c94fd3e37470156534d5f2b3472 , < f29ccaa07cf3d35990f4d25028cc55470d29372b (git)
Affected: 4a0fddc2c0d5c28aec8c262ad4603be0bef1938c (git)
Affected: 5.10.238 , < 5.10.239 (semver)
Affected: 5.15.185 , < 5.15.186 (semver)
Affected: 6.1.141 , < 6.1.142 (semver)
Affected: 6.6.93 , < 6.6.94 (semver)
Affected: 6.12.31 , < 6.12.34 (semver)
Affected: 6.14.9 , < 6.15 (semver)
Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 5.10.239 , ≤ 5.10.* (semver)
Unaffected: 5.15.186 , ≤ 5.15.* (semver)
Unaffected: 6.1.142 , ≤ 6.1.* (semver)
Unaffected: 6.6.94 , ≤ 6.6.* (semver)
Unaffected: 6.12.34 , ≤ 6.12.* (semver)
Unaffected: 6.15.3 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:36:08.105Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "445d59025d76d0638b03110f8791d5b89ed5162d",
              "status": "affected",
              "version": "d42ed4de6aba232d946d20653a70f79158a6535b",
              "versionType": "git"
            },
            {
              "lessThan": "e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029",
              "status": "affected",
              "version": "f5c2c4eaaa5a8e7e0685ec031d480e588e263e59",
              "versionType": "git"
            },
            {
              "lessThan": "307391e8fe70401a6d39ecc9978e13c2c0cdf81f",
              "status": "affected",
              "version": "b8fcae6d2e93c54cacb8f579a77d827c1c643eb5",
              "versionType": "git"
            },
            {
              "lessThan": "acab7ca5ff19889b80a8ee7dec220ee1a96dede9",
              "status": "affected",
              "version": "b19fc1d0be3c3397e5968fe2627f22e7f84673b1",
              "versionType": "git"
            },
            {
              "lessThan": "c762fc79d710d676b793f9d98b1414efe6eb51e6",
              "status": "affected",
              "version": "689a205cd968a1572ab561b0c4c2d50a10e9d3b0",
              "versionType": "git"
            },
            {
              "lessThan": "9ff60e0d9974dccf24e89bcd3ee7933e538d929f",
              "status": "affected",
              "version": "e279024617134c94fd3e37470156534d5f2b3472",
              "versionType": "git"
            },
            {
              "lessThan": "f29ccaa07cf3d35990f4d25028cc55470d29372b",
              "status": "affected",
              "version": "e279024617134c94fd3e37470156534d5f2b3472",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4a0fddc2c0d5c28aec8c262ad4603be0bef1938c",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.239",
              "status": "affected",
              "version": "5.10.238",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.186",
              "status": "affected",
              "version": "5.15.185",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.142",
              "status": "affected",
              "version": "6.1.141",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.94",
              "status": "affected",
              "version": "6.6.93",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.34",
              "status": "affected",
              "version": "6.12.31",
              "versionType": "semver"
            },
            {
              "lessThan": "6.15",
              "status": "affected",
              "version": "6.14.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "5.10.238",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "5.15.185",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "6.1.141",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "6.6.93",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.12.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.14.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tipc: fix refcount warning in tipc_aead_encrypt\n\nsyzbot reported a refcount warning [1] caused by calling get_net() on\na network namespace that is being destroyed (refcount=0). This happens\nwhen a TIPC discovery timer fires during network namespace cleanup.\n\nThe recently added get_net() call in commit e279024617134 (\"net/tipc:\nfix slab-use-after-free Read in tipc_aead_encrypt_done\") attempts to\nhold a reference to the network namespace. However, if the namespace\nis already being destroyed, its refcount might be zero, leading to the\nuse-after-free warning.\n\nReplace get_net() with maybe_get_net(), which safely checks if the\nrefcount is non-zero before incrementing it. If the namespace is being\ndestroyed, return -ENODEV early, after releasing the bearer reference.\n\n[1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The trigger is a purely local sequence \u2014 create a network namespace, enable a TIPC bearer, install an AEAD key via TIPC genetlink, then tear the namespace down \u2014 with no remote peer or packet required. `init_net`\u0027s refcount never reaches zero, so the bug is only reachable through locally-driven netns destruction.\nAC:L - The attacker controls both sides of the race: they start the discovery timer (which re-arms at least every second while the bearer is up) and they choose when to destroy the namespace, and `cleanup_net()`\u0027s window (batched teardown, `pernet_ops_rwsem`, `rcu_barrier()`) routinely exceeds that interval. The sequence is scriptable in a tight loop, and unlike the parent UAF no cryptd/SIMD fallback is needed since `get_net()` runs on every encrypt.\nPR:L - TIPC bearer-enable and key-set are gated on CAP_NET_ADMIN, but every op in net/tipc/netlink.c uses `GENL_UNS_ADMIN_PERM`, which is satisfied by CAP_NET_ADMIN in a user-namespace-owned netns \u2014 an unprivileged user reaches all of it via `unshare -Urn`. No real root in the initial namespace is required.\nUI:N - The entire sequence is performed by the attacker\u0027s own process; the discovery timer fires on its own from softirq context. No victim action or interaction of any kind is involved.\nS:U - The corrupted refcount, the freed `tipc_crypto`, and the freed `struct net` all belong to the kernel\u0027s own security authority. There is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The failed reference acquisition re-opens the slab use-after-free it was meant to close: `tipc_aead_encrypt_done()` runs from the cryptd workqueue against a `tipc_crypto` already freed by `tipc_crypto_stop()` and a `struct net` freed by `cleanup_net()`, reading `tx-\u003estats`, `b-\u003eup`, and `tx_ctx` out of reallocated slab memory. A UAF read on attacker-groomable heap is treated as arbitrary kernel memory disclosure.\nI:H - The same window yields write primitives on freed memory \u2014 `this_cpu_inc(tx-\u003estats-\u003estat[...])` through a freed per-CPU pointer and `put_net()`\u0027s atomic decrement on the freed `struct net` \u2014 which is heap-sprayable into an attacker-chosen object. Additionally the refcount is force-set to `REFCOUNT_SATURATED`, corrupting namespace lifetime accounting.\nA:H - The immediate result is a `WARN_ONCE` splat, which is an outright kernel panic on the many hardened, cloud, and syzkaller-style deployments running `panic_on_warn=1`, and the subsequent use-after-free reliably oopses even when not weaponized. The whole sequence is repeatable in a loop by an unprivileged local user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:54.344Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/445d59025d76d0638b03110f8791d5b89ed5162d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029"
        },
        {
          "url": "https://git.kernel.org/stable/c/307391e8fe70401a6d39ecc9978e13c2c0cdf81f"
        },
        {
          "url": "https://git.kernel.org/stable/c/acab7ca5ff19889b80a8ee7dec220ee1a96dede9"
        },
        {
          "url": "https://git.kernel.org/stable/c/c762fc79d710d676b793f9d98b1414efe6eb51e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ff60e0d9974dccf24e89bcd3ee7933e538d929f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f29ccaa07cf3d35990f4d25028cc55470d29372b"
        }
      ],
      "title": "net: tipc: fix refcount warning in tipc_aead_encrypt",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38273",
    "datePublished": "2025-07-10T07:41:54.415Z",
    "dateReserved": "2025-04-16T04:51:23.998Z",
    "dateUpdated": "2026-08-05T12:00:54.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38273",
      "date": "2026-08-09",
      "epss": "0.00175",
      "percentile": "0.07099"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38273\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-10T08:15:25.530\",\"lastModified\":\"2026-07-30T06:23:05.490\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: tipc: fix refcount warning in tipc_aead_encrypt\\n\\nsyzbot reported a refcount warning [1] caused by calling get_net() on\\na network namespace that is being destroyed (refcount=0). This happens\\nwhen a TIPC discovery timer fires during network namespace cleanup.\\n\\nThe recently added get_net() call in commit e279024617134 (\\\"net/tipc:\\nfix slab-use-after-free Read in tipc_aead_encrypt_done\\\") attempts to\\nhold a reference to the network namespace. However, if the namespace\\nis already being destroyed, its refcount might be zero, leading to the\\nuse-after-free warning.\\n\\nReplace get_net() with maybe_get_net(), which safely checks if the\\nrefcount is non-zero before incrementing it. If the namespace is being\\ndestroyed, return -ENODEV early, after releasing the bearer reference.\\n\\n[1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: tipc: correcci\u00f3n de la advertencia de recuento de referencias en tipc_aead_encrypt. syzbot report\u00f3 una advertencia de recuento de referencias [1] causada por la llamada a get_net() en un espacio de nombres de red que se est\u00e1 destruyendo (recuento de referencias = 0). Esto ocurre cuando se activa un temporizador de descubrimiento de TIPC durante la limpieza del espacio de nombres de red. La llamada a get_net(), recientemente a\u00f1adida en el commit e279024617134 (\\\"net/tipc: correcci\u00f3n de la lectura de slab-use-after-free en tipc_aead_encrypt_done\\\"), intenta contener una referencia al espacio de nombres de red. Sin embargo, si el espacio de nombres ya se est\u00e1 destruyendo, su recuento de referencias podr\u00eda ser cero, lo que genera la advertencia de use-after-free. Reemplace get_net() por perhaps_get_net(), que comprueba de forma segura si el recuento de referencias es distinto de cero antes de incrementarlo. Si el espacio de nombres se est\u00e1 destruyendo, devuelva -ENODEV antes de tiempo, despu\u00e9s de liberar la referencia del portador. [1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/tipc/crypto.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d42ed4de6aba232d946d20653a70f79158a6535b\",\"lessThan\":\"445d59025d76d0638b03110f8791d5b89ed5162d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f5c2c4eaaa5a8e7e0685ec031d480e588e263e59\",\"lessThan\":\"e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b8fcae6d2e93c54cacb8f579a77d827c1c643eb5\",\"lessThan\":\"307391e8fe70401a6d39ecc9978e13c2c0cdf81f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b19fc1d0be3c3397e5968fe2627f22e7f84673b1\",\"lessThan\":\"acab7ca5ff19889b80a8ee7dec220ee1a96dede9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"689a205cd968a1572ab561b0c4c2d50a10e9d3b0\",\"lessThan\":\"c762fc79d710d676b793f9d98b1414efe6eb51e6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e279024617134c94fd3e37470156534d5f2b3472\",\"lessThan\":\"9ff60e0d9974dccf24e89bcd3ee7933e538d929f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e279024617134c94fd3e37470156534d5f2b3472\",\"lessThan\":\"f29ccaa07cf3d35990f4d25028cc55470d29372b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a0fddc2c0d5c28aec8c262ad4603be0bef1938c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.238\",\"lessThan\":\"5.10.239\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.185\",\"lessThan\":\"5.15.186\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.141\",\"lessThan\":\"6.1.142\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.93\",\"lessThan\":\"6.6.94\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.31\",\"lessThan\":\"6.12.34\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.14.9\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/tipc/crypto.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.239\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.186\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.142\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.94\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.34\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.3\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.31\",\"versionEndExcluding\":\"6.12.34\",\"matchCriteriaId\":\"D24F0A12-3789-4D0F-9D46-EC46B5EF9615\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14.9\",\"versionEndExcluding\":\"6.15\",\"matchCriteriaId\":\"2932EEA2-2EDB-4FE6-9BF4-C1F90FF22950\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.15.1\",\"versionEndExcluding\":\"6.15.3\",\"matchCriteriaId\":\"94EFC2F0-D796-44B3-BB7E-D7800275E9AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.10.238:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F13BEF6-CA61-4A23-9CED-61663F79A4A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15.185:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E141EB19-F649-4D87-A508-F9B8A551E196\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1.141:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE80C371-EA85-49FF-8CEB-D5CAB2E8358E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.6.93:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6C2C1D69-D7DD-494F-BFFC-05CEC1F3675C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1ECC65A-EE37-4479-8E99-4BB68A22A31F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/307391e8fe70401a6d39ecc9978e13c2c0cdf81f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/445d59025d76d0638b03110f8791d5b89ed5162d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ff60e0d9974dccf24e89bcd3ee7933e538d929f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/acab7ca5ff19889b80a8ee7dec220ee1a96dede9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c762fc79d710d676b793f9d98b1414efe6eb51e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e0b11227c4e8eb4bdf1b86aa8f0f3abb24e0f029\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f29ccaa07cf3d35990f4d25028cc55470d29372b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:24:17+00:00",
      "cve": "CVE-2025-38273",
      "id": "CVE-2025-38273",
      "initial_release_date": "2025-07-10T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: tipc: fix refcount warning in tipc_aead_encrypt",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38273.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-15T06:11:49Z",
      "cve": "CVE-2025-38273",
      "id": "CVE-2025-38273",
      "initial_release_date": "2025-07-10T23:23:39Z",
      "product_status:first_fixed": "2",
      "product_status:known_not_affected": "333",
      "product_status:recommended": "481",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38273",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38273.json",
      "version": "37"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.