High severity · published Jun 18, 2025
CVE-2025-38079
crypto: algif_hash - fix double free in hash_accept
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_hash - fix double free in hash_accept
If accept(2) is called on socket type algif_hash with
MSG_MORE flag set and crypto_ahash_import fails,
sk2 is freed. However, it is also freed in af_alg_release,
leading to slab-use-after-free error.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
2.6.38 before 5.4.294; 5.5 before 5.10.238; 5.11 before 5.15.185; 5.16 before 6.1.141; 6.2 before 6.6.93; 6.7 before 6.12.31; +8 more · source: NVD
LI
Linux · Linux
fe869cdb89c95d060c77eea20204d6c91f233b53 before 5bff312b59b3f2a54ff504e4f4e47272b64f3633; fe869cdb89c95d060c77eea20204d6c91f233b53 before bf7bba75b91539e93615f560893a599c1e1c98bf; fe869cdb89c95d060c77eea20204d6c91f233b53 before c3059d58f79fdfb2201249c2741514e34562b547; fe869cdb89c95d060c77eea20204d6c91f233b53 before f0f3d09f53534ea385d55ced408f2b67059b16e4; fe869cdb89c95d060c77eea20204d6c91f233b53 before 134daaba93193df9e988524b5cd2f52d15eb1993; fe869cdb89c95d060c77eea20204d6c91f233b53 before 2f45a8d64fb4ed4830a4b3273834ecd6ca504896; +3 more · source: vendor
DL
Debian Linux · Debian
11.0 · source: NVD
SS
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.5; V3.1.5 · source: CISA
SS
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens
V3.1.5; V3.1.5 · source: CISA
SS
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.5 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-38079
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-38079
Patch
https://git.kernel.org/stable/c/0346f4b742345d1c733c977f3a7aef5a6419a967
Patch
https://git.kernel.org/stable/c/134daaba93193df9e988524b5cd2f52d15eb1993
Patch
https://git.kernel.org/stable/c/2f45a8d64fb4ed4830a4b3273834ecd6ca504896
Patch
https://git.kernel.org/stable/c/5bff312b59b3f2a54ff504e4f4e47272b64f3633
Patch
https://git.kernel.org/stable/c/b2df03ed4052e97126267e8c13ad4204ea6ba9b6
Patch
https://git.kernel.org/stable/c/bf7bba75b91539e93615f560893a599c1e1c98bf
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability