CVE-2025-38112

What it actually does

TOCTOU race in sk_is_readable() allows sk->sk_prot->sock_is_readable to become NULL after the initial validity check when a socket is removed from a sockmap via sk_psock_put(), resulting in a null pointer dereference.

Why it matters to the business

Kernel crashes or denial of service on Linux systems using sockmap features; widespread exposure in server and container environments increases operational risk and patch urgency despite low exploit probability.

How an attack unfolds

An attacker with local access or network-triggered socket activity performs concurrent sockmap removal and sk_is_readable calls to win the race and dereference a now-NULL function pointer, potentially leading to system instability or escalation in privileged contexts.

How to fix it

Apply the upstream fix commit c2b26638476baee154920bb587fc94ff1bf04336 or later stable equivalent; update slsa-verifier packages to 2.7.0-r6 where present.

How to confirm the fix worked

Confirm the running kernel contains commit c2b26638476baee154920bb587fc94ff1bf04336; inspect sk_is_readable callers for the added pointer-stability guard and test sockmap attach/detach under load.

Typical attack path

1. Locate Linux kernels exposing sockmap or BPF socket operations
2. Trigger socket addition to sockmap followed by immediate removal while racing sk_is_readable calls
3. Force reload of sk->sk_prot after the check but before use to obtain NULL pointer
4. Induce null dereference to crash the kernel or attempt further privilege escalation

How to detect it

Search kernel logs and crash dumps for null pointer dereferences originating from sk_is_readable or sockmap-related paths; correlate with socket map attach/detach events and any concurrent privilege-escalation attempts noted in threat reporting.

What your security team should do

• Prioritize kernel updates on all systems within 30 days given publication age and sockmap prevalence
• Restrict untrusted local access and BPF socket programs until patched
• Audit production workloads for sockmap usage and schedule staged rollouts
• Monitor kernel oops and null-dereference reports tied to network socket paths