Loading story…
CVE-2025-38500 is a use-after-free and double-free flaw in the Linux kernel's XFRM interface implementation. A logic error in xfrmi_changelink() allowed modification of a collect_md XFRM interface despite that setting being creation-time-only, placing the same interface in both the normal XFRM hash and the collect_md_xfrmi pointer. Destroying the affected network namespace can then free the interface twice, causing a kernel BUG in unregister_netdevice_many_notify(), a kernel oops, or denial of service.
The issue affects code introduced in Linux 6.1 and requires local low-privileged access with CAP_NET_ADMIN to alter XFRM interfaces. Upstream fixes are available in Linux 6.6.101, 6.12.41, 6.15.9, and 6.16. Red Hat rated the vulnerability CVSS 7.8 and released fixes for RHEL 9, RHEL 10, and RHEL 9.4 EUS; its RHEL 9 kernel-rt package remained affected at the time of the advisory.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2025:15011 to address CVE-2025-38500 in the Red Hat Enterprise Linux 9 kernel.
Red Hat released RHSA-2025:17241 to address CVE-2025-38500 for the Red Hat Enterprise Linux 9.4 Extended Update Support kernel.
Red Hat released RHSA-2025:15782 to fix CVE-2025-38500 in the Red Hat Enterprise Linux 10 kernel.
Fixes were included in Linux stable versions 6.6.101, 6.12.41, 6.15.9, and 6.16. The correction obtains the XFRM interface through netdev_priv() early in xfrmi_changelink() and blocks changes to collect_md interfaces.
The Linux kernel CVE team assigned CVE-2025-38500 to the XFRM interface flaw. An attacker with CAP_NET_ADMIN could trigger the affected path and cause a kernel crash, resulting in denial of service.
A change introduced in Linux kernel 6.1 allowed xfrmi_changelink() to modify collect_md XFRM interfaces, creating conditions for duplicate tracking and a later use-after-free/double-free during network-namespace teardown.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat addressed **CVE-2022-36879**, a moderate-severity Linux kernel flaw in the XFRM packet-transformation framework. Faulty policy resolution in `xfrm_bundle_lookup`/`xfrm_expand_policies` can decrement a reference count twice, creating a memory-lifecycle error that a local, low-privileged attacker could use to crash the kernel and cause denial of service. Red Hat rates the issue CVSS 5.5, with high availability impact and no confidentiality or integrity impact. The defect affects upstream kernels through version 5.18.14; Fedora incorporated the correction in kernel 5.18.15, while upstream Linux includes it in version 5.19. Red Hat shipped fixes for supported RHEL 8 and RHEL 9 releases, including specified kernel-rt and Extended Update Support variants, as well as Red Hat Virtualization 4 for RHEL 8. Organizations should install the applicable supported kernel update and reboot where required; RHEL 6 and RHEL 7 are outside Red Hat's supported scope for this issue.
Aug 26, 2026
A flaw tracked as **CVE-2026-43158** in the Linux kernel's **XFS** filesystem can let a local user trigger a denial of service by causing an assertion failure and filesystem shutdown. The bug affects XFS attribute leaf block handling during repeated `setxattr` operations: crafted extended attribute insertions can corrupt freemap accounting so that the entries array overlaps free space. The issue is classified as **CWE-617 Reachable Assertion**, carries a **CVSS v3 score of 7.0** from Red Hat, and traces back to code introduced in Linux `2.6.12`. The Linux kernel community published fixes across multiple stable branches, with maintainers advising organizations to update to current stable kernels rather than cherry-pick patches. Red Hat said no acceptable mitigation is available and shipped fixes through updated **RHEL** kernel packages and errata, including advisory **RHSA-2026:27735** for **RHEL 9.4 Update Services for SAP Solutions** and related variants. That advisory bundles **CVE-2026-43158** with other kernel vulnerabilities in components including **libceph**, **netfilter**, **SMB/CIFS**, **SCTP**, and **mac80211**, and requires affected systems to be rebooted after installation.
Aug 25, 2026
A **use-after-free** flaw in the Linux kernel traffic control `act_ct` path, tracked as **CVE-2026-23270**, was disclosed after maintainers found that incorrect binding to non-ingress egress qdiscs could leave the defragmentation engine holding an `skb` that had already been treated as consumed. The bug affects the `net/sched` subsystem and can let a local user with the required privileges trigger a kernel crash, causing **denial of service**, and in some cases potentially achieve **privilege escalation**. Upstream kernel maintainers fixed the issue by restricting `act_ct` so it can bind only to `clsact`/ingress qdiscs and shared blocks, while still allowing egress attachment only through `clsact`. The Linux kernel CVE team said the flaw was introduced in kernel branches starting with **6.8** and selected stable backports, with fixes released in **6.12.77**, **6.18.18**, **6.19.8**, and **7.0-rc3**. Red Hat rated the issue **Moderate** and noted that exploitation depends on a specific misconfiguration, but still shipped fixes across multiple **RHEL 8, 9, and 10** kernel packages through security errata, including **RHSA-2026:13566** for RHEL 10. That advisory bundled CVE-2026-23270 with other kernel fixes and instructed customers to install updated kernel packages and **reboot affected systems** after applying the update.
Aug 25, 2026