CVE-2025-38476

Q: What is the severity of CVE-2025-38476?

CVE-2025-38476 has a CVSS score of 7.8 (HIGH). This is a use-after-free vulnerability in the Linux kernel's RPL (Routing Protocol for Low-Power and Lossy Networks) implementation. An attacker could exploit this to cause kernel memory corruption, potentially leading to denial of service, privilege escalation, or arbitrary code execution. Systems running vulnerable Linux kernel versions with RPL functionality enabled are affected.

7.8 HIGH

Denial of Service

📋 TL;DR

This is a use-after-free vulnerability in the Linux kernel's RPL (Routing Protocol for Low-Power and Lossy Networks) implementation. An attacker could exploit this to cause kernel memory corruption, potentially leading to denial of service, privilege escalation, or arbitrary code execution. Systems running vulnerable Linux kernel versions with RPL functionality enabled are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions containing the vulnerable code up to the fix commit. Specific affected versions depend on distribution backports.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if RPL (CONFIG_IPV6_RPL) is enabled in kernel configuration. Most distributions don't enable this by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, privilege escalation to root, or remote code execution with kernel privileges.

🟠

Likely Case

Denial of service through kernel panic or system instability, potentially requiring reboot.

🟢

If Mitigated

Minimal impact if RPL is disabled or systems are properly segmented.

🌐 Internet-Facing: MEDIUM - Requires RPL functionality enabled and network access to vulnerable interface.

🏢 Internal Only: MEDIUM - Internal attackers could exploit if RPL is enabled on internal networks.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires sending specially crafted RPL packets to a system with RPL enabled. The vulnerability is triggered during packet processing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commit 034b428aa3583373a5a20b1c5931bb2b3cae1f36 and backported to stable branches

Vendor Advisory: https://git.kernel.org/stable/c/034b428aa3583373a5a20b1c5931bb2b3cae1f36

Restart Required: Yes

Instructions:

1. Update to a kernel version containing the fix commit. 2. Check your distribution's security advisories for specific patched versions. 3. Reboot the system after kernel update.

🔧 Temporary Workarounds

Disable RPL functionality

linux

Disable the RPL module if not required

echo 'blacklist rpl' >> /etc/modprobe.d/blacklist.conf
rmmod rpl_iptunnel

Block RPL traffic

linux

Use firewall rules to block RPL protocol traffic

iptables -A INPUT -p ipv6 --protocol rpl -j DROP
ip6tables -A INPUT -m rpl -j DROP

🧯 If You Can't Patch

Disable RPL kernel module if not needed
Implement network segmentation to isolate systems with RPL enabled
Use firewalls to block RPL protocol traffic at network boundaries

🔍 How to Verify

Check if Vulnerable:

Check if RPL module is loaded: lsmod | grep rpl_iptunnel. If loaded and kernel version is vulnerable, system is at risk.

Check Version:

uname -r

Verify Fix Applied:

Check kernel version contains fix commit: grep -q '034b428aa3583373a5a20b1c5931bb2b3cae1f36' /proc/version_signature || uname -r

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
KASAN reports of use-after-free in rpl_do_srh_inline
System crashes or unexpected reboots

Network Indicators:

Unusual RPL protocol traffic to systems
Spike in malformed IPv6 packets

SIEM Query:

source="kernel" AND ("KASAN" OR "use-after-free" OR "rpl_do_srh_inline")

📊 Metadata

CVE ID: CVE-2025-38476

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.02% exploit probability (4.2th percentile)

Published: July 28, 2025

Last Updated: December 22, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable RPL functionality

Block RPL traffic

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities