Linux Kernel: crypto algif_hash double free leading to use-after-free (CVE-2025-38079) #shorts

Summary

In today’s episode, we discuss CVE-2025-38079, a double-free and use-after-free vulnerability in the Linux kernel’s algif_hash crypto interface. SUSE has released security updates to address this flaw, which could be triggered by a crafted call to accept(2) with MSG_MORE on an algif_hash socket.

Product details

This issue affects the Linux kernel in SUSE distributions built from versions starting at commit fe869cdb89c9 up to but not including the fixed commits (e.g., f0f3d09f5353 and onward). SUSE has issued patches for all supported kernel branches, including patch releases for versions 2.6.38 and later.

Vulnerability type summary

CVE-2025-38079 is a memory-corruption bug caused by double freeing an sk_buff object. The root is a double free leading to slab-use-after-free, which can result in a kernel crash or potentially allow an attacker to corrupt kernel memory and escalate privileges.

Details of the vulnerability

When accept(2) is invoked on an AF_ALG socket of type algif_hash with the MSG_MORE flag set, the code path in crypto_ahash_import may fail and free the sk2 socket buffer. Later, af_alg_release also frees sk2 unconditionally. This second free on already-freed memory triggers a slab-use-after-free error. An unprivileged local user could exploit this to crash the kernel or manipulate memory.

Conclusion

SUSE users should update their Linux kernels immediately to the patched versions provided in today’s security advisory. Applying the official SUSE kernel update will eliminate the double-free defect and protect systems from potential denial-of-service or kernel-memory corruption attacks.

Watch the full video on YouTube: CVE-2025-38079

Remediation and exploitation details

This chain involves the following actors

  • Local unprivileged user: Attacker

This following systems are involved

  • Linux Kernel crypto subsystem (Handles cryptographic hashing requests on AF_ALG sockets): Victim

Attack entry point

  • AF_ALG hash_accept path: Calling accept(2) on a hash socket with the MSG_MORE flag set triggers the vulnerable code path

Remediation actions

System administrator
Apply the SUSE security update or upgrade to a Linux kernel version patched against CVE-2025-38079
Linux Kernel

Exploitation actions

Initialize a hashing socket

Local unprivileged user
Open a cryptographic socket by calling socket(AF_ALG, SOCK_SEQPACKET, 0)
Linux Kernel crypto subsystem
Examples:
  • int s = socket(AF_ALG, SOCK_SEQPACKET, 0);

Prepare the socket for accept

Local unprivileged user
Bind and listen on the socket for a chosen hash algorithm
Linux Kernel crypto subsystem
Examples:
  • struct sockaddr_alg sa = { .sa_family = AF_ALG, .sa_type = "hash", .sa_name = "sha256" };
  • bind(s, (struct sockaddr *)&sa, sizeof(sa));
  • listen(s, 1);

Trigger double free and use-after-free in hash_accept

Local unprivileged user
Call accept(2) with the MSG_MORE flag and supply malformed key data to force crypto_ahash_import to fail
Linux Kernel crypto subsystem
Examples:
  • struct msghdr msg = { .msg_iov = &iov, .msg_iovlen = 1 };
  • sendmsg(s, &msg, MSG_MORE);
  • int c = accept(s, NULL, NULL);

Cause a slab-use-after-free and crash

Local unprivileged user
Observe the kernel memory corruption leading to denial of service
Linux Kernel crypto subsystem
Examples:
  • dmesg | grep -i "slab-use-after-free"

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2025-38079
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double free in hash_accept If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_release, leading to slab-use-after-free error.
Provider
Linux
CWE / problem types
Affected Software Versions
Linux:Linux:[{'version': 'fe869cdb89c95d060c77eea20204d6c91f233b53', 'lessThan': '5bff312b59b3f2a54ff504e4f4e47272b64f3633', 'status': 'affected', 'versionType': 'git'}, {'version': 'fe869cdb89c95d060c77eea20204d6c91f233b53', 'lessThan': 'bf7bba75b91539e93615f560893a599c1e1c98bf', 'status': 'affected', 'versionType': 'git'}, {'version': 'fe869cdb89c95d060c77eea20204d6c91f233b53', 'lessThan': 'c3059d58f79fdfb2201249c2741514e34562b547', 'status': 'affected', 'versionType': 'git'}, {'version': 'fe869cdb89c95d060c77eea20204d6c91f233b53', 'lessThan': 'f0f3d09f53534ea385d55ced408f2b67059b16e4', 'status': 'affected', 'versionType': 'git'}, {'version': 'fe869cdb89c95d060c77eea20204d6c91f233b53', 'lessThan': '134daaba93193df9e988524b5cd2f52d15eb1993', 'status': 'affected', 'versionType': 'git'}, {'version': 'fe869cdb89c95d060c77eea20204d6c91f233b53', 'lessThan': '2f45a8d64fb4ed4830a4b3273834ecd6ca504896', 'status': 'affected', 'versionType': 'git'}, {'version': 'fe869cdb89c95d060c77eea20204d6c91f233b53', 'lessThan': '0346f4b742345d1c733c977f3a7aef5a6419a967', 'status': 'affected', 'versionType': 'git'}, {'version': 'fe869cdb89c95d060c77eea20204d6c91f233b53', 'lessThan': 'b2df03ed4052e97126267e8c13ad4204ea6ba9b6', 'status': 'affected', 'versionType': 'git'}],Linux:Linux:[{'version': '2.6.38', 'status': 'affected'}, {'version': '0', 'lessThan': '2.6.38', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '5.4.294', 'lessThanOrEqual': '5.4.*', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '5.10.238', 'lessThanOrEqual': '5.10.*', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '5.15.185', 'lessThanOrEqual': '5.15.*', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '6.1.141', 'lessThanOrEqual': '6.1.*', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '6.6.93', 'lessThanOrEqual': '6.6.*', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '6.12.31', 'lessThanOrEqual': '6.12.*', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '6.14.9', 'lessThanOrEqual': '6.14.*', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '6.15', 'lessThanOrEqual': '*', 'status': 'unaffected', 'versionType': 'original_commit_for_fix'}]
Date Published
2025-06-18T09:33:53.251Z
Last Updated
2025-06-18T09:33:53.251Z