CVE-2025-38273

What it actually does

Use-after-free in TIPC AEAD encryption path caused by get_net() on a network namespace whose refcount has already reached zero during cleanup when a discovery timer fires.

Why it matters to the business

Kernel warnings or potential instability on systems running TIPC in containerized or multi-namespace environments; low immediate risk given absence from known exploited lists and modest exploit probability, but still requires patching of long-running kernel deployments.

How an attack unfolds

An attacker with local access or the ability to influence network namespace lifecycle triggers TIPC discovery activity while a namespace is being torn down; the flawed get_net() call then operates on an already-destroyed object, producing the refcount warning originally reported by syzbot.

How to fix it

Upgrade Linux kernel to 5.10.239 or later, Alpaquita linux-lts stream to 6.6.58-r0 or later, Alpaquita linux-lts 23 to 6.1.62-r0 or later, or apply commit 445d59025d76d0638b03110f8791d5b89ed5162d; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm kernel version contains the maybe_get_net() replacement in tipc_aead_encrypt; run syzbot-style namespace cleanup tests under TIPC load and verify absence of refcount warnings in dmesg.

Typical attack path

1. Obtain local execution or namespace manipulation capability on a TIPC-enabled host
2. Initiate or wait for TIPC bearer/discovery timer activity
3. Trigger concurrent network namespace destruction
4. Observe refcount warning or resulting memory corruption in tipc_aead_encrypt_done

How to detect it

Search kernel logs for refcount warnings referencing tipc_aead_encrypt or get_net during namespace teardown; correlate with TIPC bearer activity and namespace destruction events in audit or system logs.

What your security team should do

• Prioritize kernel updates on any hosts exposing TIPC or running container orchestration that creates/destroys network namespaces
• Add kernel version checks to vulnerability scanning pipelines using the listed fixed versions
• Monitor for future similar refcount issues in net/tipc and schedule quarterly kernel reviews