UBUNTU-CVE-2025-38666
In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix use-after-free in AARP proxy probe The AARP proxy‐probe routine (aarp_proxy_probe_network) sends a probe, releases the aarp_lock, sleeps, then re-acquires the lock. During that window an expire timer thread (__aarp_expire_timer) can remove and kfree() the same entry, leading to a use-after-free. race condition: cpu 0 | cpu 1 atalk_sendmsg() | atif_proxy_probe_device() aarp_send_ddp() | aarp_proxy_probe_network() mod_timer() | lock(aarp_lock) // LOCK!! timeout around 200ms | alloc(aarp_entry) and then call | proxies[hash] = aarp_entry aarp_expire_timeout() | aarp_send_probe() | unlock(aarp_lock) // UNLOCK!! lock(aarp_lock) // LOCK!! | msleep(100); __aarp_expire_timer(&proxies[ct]) | free(aarp_entry) | unlock(aarp_lock) // UNLOCK!! | | lock(aarp_lock) // LOCK!! | UAF aarp_entry !! ================================================================== BUG: KASAN: slab-use-after-free in aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493 Read of size 4 at addr ffff8880123aa360 by task repro/13278 CPU: 3 UID: 0 PID: 13278 Comm: repro Not tainted 6.15.2 #3 PREEMPT(full) Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc1/0x630 mm/kasan/report.c:521 kasan_report+0xca/0x100 mm/kasan/report.c:634 aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493 atif_proxy_probe_device net/appletalk/ddp.c:332 [inline] atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818 sock_do_ioctl+0xdc/0x260 net/socket.c:1190 sock_ioctl+0x239/0x6a0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x194/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcb/0x250 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated: aarp_alloc net/appletalk/aarp.c:382 [inline] aarp_proxy_probe_network+0xd8/0x630 net/appletalk/aarp.c:468 atif_proxy_probe_device net/appletalk/ddp.c:332 [inline] atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818 Freed: kfree+0x148/0x4d0 mm/slub.c:4841 __aarp_expire net/appletalk/aarp.c:90 [inline] __aarp_expire_timer net/appletalk/aarp.c:261 [inline] aarp_expire_timeout+0x480/0x6e0 net/appletalk/aarp.c:317 The buggy address belongs to the object at ffff8880123aa300 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 96 bytes inside of freed 192-byte region [ffff8880123aa300, ffff8880123aa3c0) Memory state around the buggy address: ffff8880123aa200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880123aa280: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880123aa300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880123aa380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880123aa400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================
02 / AFFECTED SOFTWARE
Affected packages
10 explicit affected versions
26 explicit affected versions
19 explicit affected versions
6 explicit affected versions
64 explicit affected versions
4 explicit affected versions
11 explicit affected versions
45 explicit affected versions
130 explicit affected versions
9 explicit affected versions
16 explicit affected versions
7 explicit affected versions
9 explicit affected versions
7 explicit affected versions
9 explicit affected versions
3 explicit affected versions
108 explicit affected versions
75 explicit affected versions
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
85 explicit affected versions
24 explicit affected versions
70 explicit affected versions
70 explicit affected versions
10 explicit affected versions
83 explicit affected versions
76 explicit affected versions
65 explicit affected versions
10 explicit affected versions
26 explicit affected versions
26 explicit affected versions
77 explicit affected versions
191 explicit affected versions
7 explicit affected versions
74 explicit affected versions
30 explicit affected versions
13 explicit affected versions
77 explicit affected versions
33 explicit affected versions
35 explicit affected versions
37 explicit affected versions
35 explicit affected versions
18 explicit affected versions
32 explicit affected versions
109 explicit affected versions
1 explicit affected versions
35 explicit affected versions
113 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
21 explicit affected versions
114 explicit affected versions
41 explicit affected versions
116 explicit affected versions
1 explicit affected versions
67 explicit affected versions
37 explicit affected versions
8 explicit affected versions
7 explicit affected versions
12 explicit affected versions
7 explicit affected versions
12 explicit affected versions
14 explicit affected versions
10 explicit affected versions
1 explicit affected versions
97 explicit affected versions
12 explicit affected versions
99 explicit affected versions
12 explicit affected versions
30 explicit affected versions
113 explicit affected versions
31 explicit affected versions
11 explicit affected versions
22 explicit affected versions
23 explicit affected versions
10 explicit affected versions
181 explicit affected versions
37 explicit affected versions
8 explicit affected versions
13 explicit affected versions
29 explicit affected versions
3 explicit affected versions
10 explicit affected versions
9 explicit affected versions
52 explicit affected versions
1 explicit affected versions
26 explicit affected versions
2 explicit affected versions
13 explicit affected versions
24 explicit affected versions
45 explicit affected versions
1 explicit affected versions
29 explicit affected versions
103 explicit affected versions
13 explicit affected versions
10 explicit affected versions
82 explicit affected versions
30 explicit affected versions
30 explicit affected versions
1 explicit affected versions
94 explicit affected versions
77 explicit affected versions
40 explicit affected versions
33 explicit affected versions
23 explicit affected versions
46 explicit affected versions
10 explicit affected versions
9 explicit affected versions
8 explicit affected versions
107 explicit affected versions
11 explicit affected versions
5 explicit affected versions
12 explicit affected versions
7 explicit affected versions
12 explicit affected versions
2 explicit affected versions
4 explicit affected versions
62 explicit affected versions
122 explicit affected versions
78 explicit affected versions
158 explicit affected versions
144 explicit affected versions
30 explicit affected versions
1 explicit affected versions
54 explicit affected versions
24 explicit affected versions
124 explicit affected versions
36 explicit affected versions
9 explicit affected versions
13 explicit affected versions
35 explicit affected versions
130 explicit affected versions
71 explicit affected versions
16 explicit affected versions
76 explicit affected versions
39 explicit affected versions
84 explicit affected versions
1 explicit affected versions
7 explicit affected versions
2 explicit affected versions
51 explicit affected versions
83 explicit affected versions
18 explicit affected versions
31 explicit affected versions
12 explicit affected versions
64 explicit affected versions
65 explicit affected versions
27 explicit affected versions
51 explicit affected versions
113 explicit affected versions
1 explicit affected versions
1 explicit affected versions
88 explicit affected versions
32 explicit affected versions
8 explicit affected versions
42 explicit affected versions
5 explicit affected versions
3 explicit affected versions
8 explicit affected versions
1 explicit affected versions
10 explicit affected versions
7 explicit affected versions
35 explicit affected versions
13 explicit affected versions
102 explicit affected versions
13 explicit affected versions
64 explicit affected versions
7 explicit affected versions
8 explicit affected versions
85 explicit affected versions
10 explicit affected versions
12 explicit affected versions
25 explicit affected versions
101 explicit affected versions
74 explicit affected versions
48 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
37 explicit affected versions
40 explicit affected versions
14 explicit affected versions
38 explicit affected versions
9 explicit affected versions
11 explicit affected versions
28 explicit affected versions
11 explicit affected versions
78 explicit affected versions
8 explicit affected versions
7 explicit affected versions
90 explicit affected versions
134 explicit affected versions
113 explicit affected versions
67 explicit affected versions
1 explicit affected versions
1 explicit affected versions
1 explicit affected versions
13 explicit affected versions
76 explicit affected versions
104 explicit affected versions
67 explicit affected versions
66 explicit affected versions
43 explicit affected versions
69 explicit affected versions
137 explicit affected versions
111 explicit affected versions
158 explicit affected versions
10 explicit affected versions
8 explicit affected versions
34 explicit affected versions
81 explicit affected versions
14 explicit affected versions
4 explicit affected versions
78 explicit affected versions
11 explicit affected versions
1 explicit affected versions
60 explicit affected versions
115 explicit affected versions
8 explicit affected versions
28 explicit affected versions
66 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix use-after-free in AARP proxy probe The AARP proxy‐probe routine (aarp_proxy_probe_network) sends a probe, releases the aarp_lock, sleeps, then re-acquires the lock. During that window an expire timer thread (__aarp_expire_timer) can remove and kfree() the same entry, leading to a use-after-free. race condition: cpu 0 | cpu 1 atalk_sendmsg() | atif_proxy_probe_device() aarp_send_ddp() | aarp_proxy_probe_network() mod_timer() | lock(aarp_lock) // LOCK!! timeout around 200ms | alloc(aarp_entry) and then call | proxies[hash] = aarp_entry aarp_expire_timeout() | aarp_send_probe() | unlock(aarp_lock) // UNLOCK!! lock(aarp_lock) // LOCK!! | msleep(100); __aarp_expire_timer(&proxies[ct]) | free(aarp_entry) | unlock(aarp_lock) // UNLOCK!! | | lock(aarp_lock) // LOCK!! | UAF aarp_entry !! ================================================================== BUG: KASAN: slab-use-after-free in aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493 Read of size 4 at addr ffff8880123aa360 by task repro/13278 CPU: 3 UID: 0 PID: 13278 Comm: repro Not tainted 6.15.2 #3 PREEMPT(full) Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc1/0x630 mm/kasan/report.c:521 kasan_report+0xca/0x100 mm/kasan/report.c:634 aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493 atif_proxy_probe_device net/appletalk/ddp.c:332 [inline] atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818 sock_do_ioctl+0xdc/0x260 net/socket.c:1190 sock_ioctl+0x239/0x6a0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x194/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcb/0x250 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated: aarp_alloc net/appletalk/aarp.c:382 [inline] aarp_proxy_probe_network+0xd8/0x630 net/appletalk/aarp.c:468 atif_proxy_probe_device net/appletalk/ddp.c:332 [inline] atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818 Freed: kfree+0x148/0x4d0 mm/slub.c:4841 __aarp_expire net/appletalk/aarp.c:90 [inline] __aarp_expire_timer net/appletalk/aarp.c:261 [inline] aarp_expire_timeout+0x480/0x6e0 net/appletalk/aarp.c:317 The buggy address belongs to the object at ffff8880123aa300 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 96 bytes inside of freed 192-byte region [ffff8880123aa300, ffff8880123aa3c0) Memory state around the buggy address: ffff8880123aa200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880123aa280: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880123aa300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880123aa380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880123aa400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/6c4a92d07b0850342d3becf2e608f805e972467c
- https://git.kernel.org/stable/c/2a6209e4649d45fd85d4193abc481911858ffc6f
- https://git.kernel.org/stable/c/5f02ea0f63dd38c41539ea290fcc1693c73aa8e5
- https://git.kernel.org/stable/c/6c4a92d07b0850342d3becf2e608f805e972467c
- https://git.kernel.org/stable/c/e4f1564c5b699eb89b3040688fd6b4e57922f1f6
- https://git.kernel.org/stable/c/f90b6bb203f3f38bf2b3d976113d51571df9a482
- https://ubuntu.com/security/CVE-2025-38666
- https://ubuntu.com/security/notices/USN-7879-1
- https://ubuntu.com/security/notices/USN-7879-2
- https://ubuntu.com/security/notices/USN-7879-3
- https://ubuntu.com/security/notices/USN-7879-4
- https://ubuntu.com/security/notices/USN-7880-1
- https://ubuntu.com/security/notices/USN-7907-1
- https://ubuntu.com/security/notices/USN-7907-2
- https://ubuntu.com/security/notices/USN-7907-3
- https://ubuntu.com/security/notices/USN-7907-4
- https://ubuntu.com/security/notices/USN-7907-5
- https://ubuntu.com/security/notices/USN-7909-1
- https://ubuntu.com/security/notices/USN-7909-2
- https://ubuntu.com/security/notices/USN-7909-3
- https://ubuntu.com/security/notices/USN-7909-4
- https://ubuntu.com/security/notices/USN-7909-5
- https://ubuntu.com/security/notices/USN-7910-1
- https://ubuntu.com/security/notices/USN-7910-2
- https://ubuntu.com/security/notices/USN-7922-1
- https://ubuntu.com/security/notices/USN-7922-2
- https://ubuntu.com/security/notices/USN-7922-3
- https://ubuntu.com/security/notices/USN-7922-4
- https://ubuntu.com/security/notices/USN-7922-5
- https://ubuntu.com/security/notices/USN-7930-1
- https://ubuntu.com/security/notices/USN-7930-2
- https://ubuntu.com/security/notices/USN-7931-1
- https://ubuntu.com/security/notices/USN-7931-2
- https://ubuntu.com/security/notices/USN-7931-3
- https://ubuntu.com/security/notices/USN-7931-4
- https://ubuntu.com/security/notices/USN-7931-5
- https://ubuntu.com/security/notices/USN-7933-1
- https://ubuntu.com/security/notices/USN-7934-1
- https://ubuntu.com/security/notices/USN-7935-1
- https://ubuntu.com/security/notices/USN-7937-1
- https://ubuntu.com/security/notices/USN-7938-1
- https://ubuntu.com/security/notices/USN-7939-1
- https://ubuntu.com/security/notices/USN-7939-2
- https://ubuntu.com/security/notices/USN-7940-1
- https://ubuntu.com/security/notices/USN-7940-2
- https://www.cve.org/CVERecord?id=CVE-2025-38666