CVE-2025-38475
Description
A flaw was found in the Linux kernel. This vulnerability exists within the smc (Shared Memory Communications over Remote Direct Memory Access) socket type implementation, where a type confusion error can occur. A local user can exploit this flaw, leading to a double-free condition that results in a Denial of Service (DoS) on the system.
Statement
A denial-of-service vulnerability of moderate impact was found in the Linux kernel SMC (Shared Memory Communications over RDMA) socket implementation in Red Hat Enterprise Linux 9 and 10. The SMC socket structure (struct smc_sock) reuses the AF_INET/AF_INET6 socket family without embedding struct inet_sock as its first member, so INET-specific code misinterprets SMC socket fields: in the CIPSO/NetLabel path used by SMACK labeling, the inet_sock.inet_opt pointer actually aliases the smc_sock.clcsk_data_ready function pointer in read-only kernel text. A local user with typical privileges on the system can exploit this type confusion by creating an SMC socket that is handled as an INET socket and triggering INET socket-option processing, causing the kernel to attempt to free read-only kernel memory multiple times (a double-free) and leading to a kernel oops that crashes the system. Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) are affected and are currently recorded with an out-of-support-scope resolution. Red Hat Enterprise Linux 6, 7, and 8 (kernel and kernel-rt) and Red Hat In-Vehicle OS 1 are not affected because the vulnerable code is not present in those offerings. Red Hat rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because a successful attack affects only system availability; the CVE.org record scores it High (7.8) by assuming full confidentiality, integrity, and availability impact, which is not supported by the technical evidence.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | High |
| Integrity Impact | None | None | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
