CVE-2025-38079

What it actually does

Double-free in algif_hash socket handling when accept(2) is invoked with MSG_MORE and crypto_ahash_import subsequently fails, resulting in slab use-after-free.

Why it matters to the business

Local attackers on affected Linux kernels can corrupt kernel memory and potentially escalate privileges to root, risking full system compromise across servers, desktops, and embedded devices using the vulnerable kernel versions.

How an attack unfolds

An attacker with local access creates an algif_hash socket, calls accept with the MSG_MORE flag, forces crypto_ahash_import to fail, and triggers the double-free path that leads to a use-after-free; listed threat actors have shown interest in similar Linux kernel memory corruption issues for espionage and financial gain.

How to fix it

Upgrade the Linux kernel to a version containing commit 5bff312b59b3f2a54ff504e4f4e47272b64f3633 or later; apply vendor-supplied updates for all affected distributions and rebuild any custom kernels with the fix.

How to confirm the fix worked

Confirm kernel source contains commit 5bff312b59b3f2a54ff504e4f4e47272b64f3633, verify the double-free path in algif_hash.c is removed, and run regression tests exercising algif_hash accept with MSG_MORE.

Typical attack path

1. Obtain local shell on target Linux system
2. Create AF_ALG socket of type algif_hash
3. Invoke accept(2) with MSG_MORE flag set
4. Arrange for crypto_ahash_import to fail
5. Trigger double-free and subsequent use-after-free for memory corruption or code execution

How to detect it

Review kernel logs for slab-use-after-free reports referencing algif_hash or hash_accept; examine auditd or syscall logs for unusual accept calls on AF_ALG sockets with MSG_MORE; correlate with any observed local privilege-escalation attempts by the listed threat actors.

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-user Linux systems within the next patching cycle
• Monitor EPSS trend and any new exploit publications given the 496 days since disclosure
• Restrict untrusted local accounts and consider seccomp or LSM policies that limit AF_ALG socket usage where feasible