Cloudanix VulnDB

CVE-2025-38666

None

CVSS

—

EPSS

0.2%

Published

Aug 22, 2025

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A timing flaw in an old networking component of the Linux kernel can let one part of the system use memory that another part has already freed, risking crashes or security issues on affected machines.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition between aarp_proxy_probe_network releasing aarp_lock, sleeping, and re-acquiring it, allowing __aarp_expire_timer to kfree the aarp_entry, resulting in use-after-free on subsequent access.

Why it matters to the business

Potential kernel memory corruption or denial of service on systems exposing Appletalk interfaces, though impact is limited due to the protocol's obsolescence and low adoption.

How an attack unfolds

An attacker with local access invokes atalk_ioctl or atalk_sendmsg to trigger aarp_proxy_probe_network, which drops the lock and sleeps; a concurrent timer expiration frees the entry, leading to UAF on reacquisition.

How to fix it

Upgrade the Linux kernel to commit b35694ffabb2af308a1f725d70f60fd8a47d1f3e or later; disable Appletalk (CONFIG_APPLETALK=n) if unused.

How to confirm the fix worked

Confirm kernel version contains the referenced commit; attempt to reproduce the KASAN-reported UAF with the provided reproducer after patching.

Typical attack path

  1. Invoke atalk_ioctl to initiate proxy probe on an Appletalk interface
  2. aarp_proxy_probe_network acquires aarp_lock, allocates entry, sends probe, then releases lock and sleeps
  3. Parallel aarp_expire_timeout thread acquires lock and frees the same aarp_entry via __aarp_expire_timer
  4. Probe thread reacquires lock and accesses freed entry, triggering UAF

How to detect it

Search kernel logs for KASAN reports referencing aarp_proxy_probe_network or aarp.c; inspect for Appletalk-related ioctl activity around crash timestamps.

What your security team should do

  • Apply the referenced kernel commit or distribution update immediately on any system still compiling or running Appletalk code
  • Audit for Appletalk usage and remove the protocol stack where possible
  • Monitor for future similar races in legacy network protocol handlers

The record

In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix use-after-free in AARP proxy probe The AARP proxy‐probe routine (aarp_proxy_probe_network) sends a probe, releases the aarp_lock, sleeps, then re-acquires the lock. During that window an expire timer thread (__aarp_expire_timer) can remove and kfree() the same entry, leading to a use-after-free. race condition: cpu 0 | cpu 1 atalk_sendmsg() | atif_proxy_probe_device() aarp_send_ddp() | aarp_proxy_probe_network() mod_timer() | lock(aarp_lock) // LOCK!! timeout around 200ms | alloc(aarp_entry) and then call | proxies[hash] = aarp_entry aarp_expire_timeout() | aarp_send_probe() | unlock(aarp_lock) // UNLOCK!! lock(aarp_lock) // LOCK!! | msleep(100); __aarp_expire_timer(&proxies[ct]) | free(aarp_entry) | unlock(aarp_lock) // UNLOCK!! | | lock(aarp_lock) // LOCK!! | UAF aarp_entry !! ================================================================== BUG: KASAN: slab-use-after-free in aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493 Read of size 4 at addr ffff8880123aa360 by task repro/13278 CPU: 3 UID: 0 PID: 13278 Comm: repro Not tainted 6.15.2 #3 PREEMPT(full) Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc1/0x630 mm/kasan/report.c:521 kasan_report+0xca/0x100 mm/kasan/report.c:634 aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493 atif_proxy_probe_device net/appletalk/ddp.c:332 [inline] atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818 sock_do_ioctl+0xdc/0x260 net/socket.c:1190 sock_ioctl+0x239/0x6a0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x194/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcb/0x250 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated: aarp_alloc net/appletalk/aarp.c:382 [inline] aarp_proxy_probe_network+0xd8/0x630 net/appletalk/aarp.c:468 atif_proxy_probe_device net/appletalk/ddp.c:332 [inline] atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818 Freed: kfree+0x148/0x4d0 mm/slub.c:4841 __aarp_expire net/appletalk/aarp.c:90 [inline] __aarp_expire_timer net/appletalk/aarp.c:261 [inline] aarp_expire_timeout+0x480/0x6e0 net/appletalk/aarp.c:317 The buggy address belongs to the object at ffff8880123aa300 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 96 bytes inside of freed 192-byte region [ffff8880123aa300, ffff8880123aa3c0) Memory state around the buggy address: ffff8880123aa200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880123aa280: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880123aa300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880123aa380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880123aa400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:12 linux 0 No fix
Debian:13 linux 0 6.12.41-1
Debian:14 linux 0 No fix
Debian:14 linux 0 6.16.3-1
Linux Kernel 2.6.12 5.4.297

Related vulnerabilities