Canonical Ubuntu Linux up to 6.7 skb_get use after free

Summaryinfo

A vulnerability classified as critical was found in Canonical Ubuntu Linux up to 6.7. Impacted is the function skb_get. Such manipulation leads to use after free. This vulnerability is traded as CVE-2025-13350. An attack has to be approached locally. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Canonical Ubuntu Linux up to 6.7. It has been rated as critical. Affected by this issue is the function skb_get. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Ubuntu Linux 6.8 GA retains the legacy AF_UNIX garbage collector but backports upstream commit 8594d9b85c07 ("af_unix: Don’t call skb_get() for OOB skb"). When orphaned MSG_OOB sockets hit unix_gc(), the garbage collector still calls kfree_skb() as if OOB SKBs held two references; on Ubuntu Linux 6.8 (Noble Numbat) kernel tree, they have only the queue reference, so the buffer is freed while still reachable and subsequent queue walks dereference freed memory, yielding a reliable local privilege escalation (LPE) caused by a use-after-free (UAF). Ubuntu builds that have already taken the new GC stack from commit 4090fa373f0e, and mainline Linux kernels shipping that infrastructure are unaffected because they no longer execute the legacy collector path. This issue affects Ubuntu Linux from 6.8.0-56.58 before 6.8.0-84.84.

The weakness was shared by Noam Rathaus. The advisory is shared for download at bugs.launchpad.net. This vulnerability is handled as CVE-2025-13350 since 11/18/2025. The exploitation is known to be difficult. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading to version 6.8.0-84.84 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-208322). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Canonical

Name

• Ubuntu Linux

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion