CVE-2025-38666 in Linux
Sumário
de VulDB • 20/07/2026
No kernel do Linux, a seguinte vulnerabilidade foi corrigida:
net: appletalk: Corrige use-after-free no probe de proxy AARP
A rotina de proxy-probe do AARP (aarp_proxy_probe_network) envia um probe, libera o aarp_lock, entra em estado de espera (sleep), e então readquire o lock. Durante essa janela, uma thread de timer de expiração (__aarp_expire_timer) pode remover e chamar kfree() na mesma entrada, levando a um use-after-free.
race condition:
cpu 0 | cpu 1 atalk_sendmsg() | atif_proxy_probe_device() aarp_send_ddp() | aarp_proxy_probe_network() mod_timer() | lock(aarp_lock) // LOCK!! timeout around 200ms | alloc(aarp_entry) and then call | proxies[hash] = aarp_entry
aarp_expire_timeout() | aarp_send_probe() | unlock(aarp_lock) // UNLOCK!! lock(aarp_lock) // LOCK!! | msleep(100); __aarp_expire_timer(&proxies[ct]) |
free(aarp_entry) | unlock(aarp_lock) // UNLOCK!! | | lock(aarp_lock) // LOCK!! | UAF aarp_entry !!
================================================================== BUG: KASAN: slab-use-after-free in aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493
If you want to get best quality of vulnerability data, you may have to visit VulDB.