CVE-2025-38708

What it actually does

Missing kref_get in DRBD handle_write_conflicts leads to premature drbd_destroy_device and use-after-free when two-primaries mode processes superseded writes, causing kernel crashes.

Why it matters to the business

Rare but possible kernel instability or crashes on systems using DRBD replication with concurrent writes enabled, though production cluster filesystems and live migration typically avoid this path; low urgency given 418 days since publication and stable low EPSS.

How an attack unfolds

An attacker triggers simultaneous writes to the same sector on both nodes in a two-primaries DRBD setup, causing the kernel to mishandle a superseded write without the required reference count, resulting in use-after-free and crash; the path is noted as test-only in real deployments and unrelated listed threat actors target different kernel issues.

How to fix it

Update Linux kernel to commit 0336bfe9c237476bd7c45605a36ca79c2bca62e5 or later; for MinimOS mariadb packages upgrade to 11.4.6-r0 or equivalent fixed builds; disable two-primaries if unused.

How to confirm the fix worked

Verify kernel source contains the kref_get addition in handle_write_conflicts; confirm package versions match listed fixed releases; test DRBD two-primaries with concurrent writes in a lab to ensure no crashes.

Typical attack path

1. Enable two-primaries on DRBD resource
2. Submit concurrent writes to identical sectors from both nodes
3. Trigger superseded write handling path
4. Exploit missing kref_get to free device structure while still referenced
5. Cause use-after-free leading to kernel panic or potential escalation

How to detect it

Review kernel logs for use-after-free or drbd_destroy_device references during DRBD write conflict handling; correlate with two-primaries configurations and concurrent write attempts; no widespread exploitation reported.

What your security team should do

• Prioritize kernel upgrades on any systems with DRBD two-primaries enabled
• Audit configurations to confirm two-primaries necessity and upper-layer write coordination
• Monitor for kernel oops or panic logs mentioning drbd_destroy_device
• Apply updates within standard patch cycles given low EPSS and non-KEV status