CVE-2025-38550

Q: What is the severity of CVE-2025-38550?

CVE-2025-38550 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's IPv6 multicast implementation. An attacker could potentially exploit this to cause a kernel panic (denial of service) or possibly execute arbitrary code with kernel privileges. All Linux systems with IPv6 enabled are potentially affected.

7.8 HIGH

Denial of Service

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's IPv6 multicast implementation. An attacker could potentially exploit this to cause a kernel panic (denial of service) or possibly execute arbitrary code with kernel privileges. All Linux systems with IPv6 enabled are potentially affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected kernel versions not specified in CVE description, but likely multiple stable branches before the fix commits.

Operating Systems: All Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires IPv6 to be enabled and the system to be processing multicast traffic. Many distributions enable IPv6 by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, or potential arbitrary code execution with kernel privileges resulting in complete system compromise.

🟠

Likely Case

Kernel panic causing system crash and denial of service, requiring physical or remote console access to reboot.

🟢

If Mitigated

No impact if IPv6 is disabled or if the system is not processing multicast traffic.

🌐 Internet-Facing: MEDIUM - Requires IPv6 connectivity and multicast traffic, which is less common than IPv4 but still present in many networks.

🏢 Internal Only: MEDIUM - Same requirements as internet-facing, but internal networks may have more IPv6 multicast traffic.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: HIGH - Requires specific timing and network conditions to trigger the use-after-free condition.

Exploitation requires sending crafted IPv6 multicast packets to trigger the vulnerable code path in mld_del_delrec().

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 5f18e0130194550dff734e155029ae734378b5ea, 6e4eec86fe5f6b3fdbc702d1d36ac2a6e7ec0806, 728db00a14cacb37f36e9382ab5fad55caf890cc, 7929d27c747eafe8fca3eecd74a334503ee4c839, ae3264a25a4635531264728859dbe9c659fad554

Vendor Advisory: https://git.kernel.org/stable/c/5f18e0130194550dff734e155029ae734378b5ea

Restart Required: Yes

Instructions:

1. Update to a kernel version containing the fix commits. 2. Check your distribution's security advisories for patched kernel packages. 3. Reboot the system after kernel update.

🔧 Temporary Workarounds

Disable IPv6

linux

Completely disable IPv6 to prevent exploitation of this vulnerability

echo 'net.ipv6.conf.all.disable_ipv6 = 1' >> /etc/sysctl.conf
echo 'net.ipv6.conf.default.disable_ipv6 = 1' >> /etc/sysctl.conf
sysctl -p

Block IPv6 multicast traffic

linux

Use firewall rules to block incoming IPv6 multicast traffic

ip6tables -A INPUT -d ff00::/8 -j DROP

🧯 If You Can't Patch

Disable IPv6 completely if not needed
Implement strict network segmentation to limit multicast traffic exposure

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with distribution's security advisories. Vulnerable if running kernel without the fix commits.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated to one containing the fix commits. Check with: uname -r and compare with patched versions from distribution.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/messages or dmesg
System crash/reboot logs
IPv6 multicast-related errors

Network Indicators:

Unusual IPv6 multicast traffic patterns
Spike in IPv6 multicast packets to target systems

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "general protection fault") AND process="kernel"

📊 Metadata

CVE ID: CVE-2025-38550

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score: 0.02% exploit probability (2.7th percentile)

Published: August 16, 2025

Last Updated: January 7, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable IPv6

Block IPv6 multicast traffic

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export