CVE-2025-38079

Q: What is the severity of CVE-2025-38079?

CVE-2025-38079 has a CVSS score of 7.8 (HIGH). This CVE describes a double-free vulnerability in the Linux kernel's crypto subsystem, specifically in the algif_hash socket interface. When accept() is called with MSG_MORE flag and crypto_ahash_import fails, the same memory is freed twice, leading to memory corruption. This affects systems using Linux kernel with the affected crypto module loaded.

7.8 HIGH

Denial of Service

📋 TL;DR

This CVE describes a double-free vulnerability in the Linux kernel's crypto subsystem, specifically in the algif_hash socket interface. When accept() is called with MSG_MORE flag and crypto_ahash_import fails, the same memory is freed twice, leading to memory corruption. This affects systems using Linux kernel with the affected crypto module loaded.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE, but patches exist for multiple stable branches

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Requires CONFIG_CRYPTO_USER_API_HASH enabled and algif_hash socket usage. Not all systems load this module by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory corruption leading to system crash, privilege escalation, or remote code execution depending on exploit sophistication.

🟠

Likely Case

Kernel panic or system crash causing denial of service.

🟢

If Mitigated

Limited impact if exploit attempts are blocked by security controls or affected module not in use.

🌐 Internet-Facing: MEDIUM - Requires specific socket operations and crypto module usage, not directly network-exposed by default.

🏢 Internal Only: MEDIUM - Local users or processes with socket access could trigger the vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access or ability to create specific socket operations. Exploit would need to trigger the specific error condition.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with fixes referenced in CVE

Vendor Advisory: https://git.kernel.org/stable/c/0346f4b742345d1c733c977f3a7aef5a6419a967

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. For custom kernels, apply patches from kernel.org stable branches. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable vulnerable module

linux

Prevent loading of the algif_hash module if not required

echo 'install algif_hash /bin/false' >> /etc/modprobe.d/disable-algif_hash.conf
rmmod algif_hash 2>/dev/null || true

Restrict socket access

linux

Limit which users can create crypto sockets

# Use SELinux/AppArmor to restrict AF_ALG socket creation
# Or implement custom seccomp filters

🧯 If You Can't Patch

Ensure CONFIG_CRYPTO_USER_API_HASH is disabled in kernel configuration
Implement strict access controls to prevent unauthorized users from creating crypto sockets

🔍 How to Verify

Check if Vulnerable:

Check if algif_hash module is loaded: lsmod | grep algif_hash. Check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated to patched version and algif_hash module is either not loaded or updated.

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages mentioning 'slab-use-after-free'
System crashes or panics related to crypto operations
dmesg entries about algif_hash or hash_accept failures

Network Indicators:

Unusual socket creation patterns for AF_ALG sockets

SIEM Query:

source="kernel" AND ("slab-use-after-free" OR "algif_hash" OR "hash_accept")

📊 Metadata

CVE ID: CVE-2025-38079

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-415

EPSS Score: 0.02% exploit probability (5.3th percentile)

Published: June 18, 2025

Last Updated: December 17, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable vulnerable module

Restrict socket access

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities