Medium

Linux kernel espintcp encapsulation socket reference leak

IdentifiersCVE-2025-38097CWE-772

CVE-2025-38097 is a Linux kernel flaw in the espintcp code path caused by caching an encapsulation socket associated with XFRM state. The cached reference creates a retention chain from xfrm_state to the encapsulation socket and then to the network namespace. Because the encapsulation socket is a userspace socket that itself holds a reference to the network namespace, the cached socket can prevent proper teardown of the namespace when the XFRM state remains present. If the espintcp state is deleted before namespace removal, the socket reference is dropped and cleanup succeeds; otherwise, once the namespace is no longer reachable through running processes, the lingering XFRM state may keep the socket and namespace pinned. The upstream fix removes encapsulation socket caching to eliminate the reference leak.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful triggering of this flaw can prevent proper cleanup of affected network namespaces, resulting in a kernel resource leak and potential denial of service through exhaustion of namespace- or socket-related resources over time. The issue is primarily an availability problem rather than a direct code-execution or privilege-escalation primitive.

Mitigation

If you can’t patch tonight, do this now.

No specific workaround is documented beyond applying a fixed kernel. As an operational mitigation, reduce use of affected espintcp/XFRM configurations in environments that frequently create and destroy network namespaces, and ensure stale espintcp/XFRM state is removed before namespace teardown where feasible. These measures may reduce exposure but do not fully remediate the flaw.

Remediation

Patch, then assume compromise.

Update to a Linux kernel release that includes the fix for CVE-2025-38097, which removes espintcp encapsulation socket caching. Vendor kernel updates incorporating the fix should be applied according to platform guidance, and systems should be rebooted after kernel upgrade where required for the new kernel to take effect.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

DebianDebian Linuxoperating_system

LinuxLinux Kerneloperating_system

SuseLinux Enterprise Server 15 Sp6 Azure Kerneloperating_system

SuseLinux Kerneloperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

redhat accessNews

May 19, 2026

RHSA-2026:18134 - Security Advisory - Red Hat Customer Portal

Linux kernel espintcp vulnerability involving a reference leak caused by encapsulation socket caching.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1