CVE-2025-38154

What it actually does

Use-after-free in Linux kernel BPF sockmap when sk_socket is dereferenced without proper locking or reference counting in the backlog thread during skb_send_sock, allowing concurrent sock_map_close to free the socket and trigger a panic in sock_sendmsg.

Why it matters to the business

Linux systems may experience sudden kernel crashes or instability when network sockets are closed while BPF sockmap operations are active, leading to service outages and potential local privilege escalation.

How an attack unfolds

An attacker with local access triggers the race by performing sockmap operations while concurrently closing sockets from another thread or process; the backlog workqueue then dereferences the freed sk_socket, resulting in a crash or arbitrary code execution. Threat actors associated with Linux kernel privilege escalation campaigns may chain this with other kernel flaws for root access.

How to fix it

Upgrade Linux kernel to fixed versions including 5.15.186 or the commit 4edb40b05cb6a261775abfd8046804ca139a5546; apply vendor patches for Mageia packages thunderbird 91.13.0-1.mga8 and thunderbird-l10n 91.13.0-1.mga8; rebuild and reboot affected systems.

How to confirm the fix worked

Verify running kernel version against fixed releases, confirm presence of the reference count increment in sock_map_close, and test socket close operations under load with sockmap enabled to ensure no panics occur.

Typical attack path

1. Obtain local unprivileged access on a vulnerable Linux system
2. Set up BPF sockmap with TCP/UDP/UNIX/VSOCK sockets
3. Trigger concurrent close(fd) from one context while backlog thread executes skb_send_sock
4. Cause sock_map_close to zero psock reference and free sk_socket without waiting for in-flight work
5. Dereference freed socket in sock_sendmsg leading to panic or controlled memory corruption

How to detect it

Search kernel logs for workqueue events named sk_psock_backlog, RIP values pointing to sock_sendmsg, and general protection faults during socket close operations; inspect audit logs for unusual local socket and BPF activity around crash times.

What your security team should do

• Prioritize kernel upgrades on all production Linux hosts within the next maintenance window due to local exploit potential
• Monitor for kernel oops/panic logs related to sk_psock_backlog and sock_sendmsg
• Restrict unprivileged BPF and sockmap usage via system policies until patches are deployed
• Review downstream package dependencies for affected Mageia and other distributions