SB2025082843 - Use-after-free in Linux kernel appletalk
Published: August 28, 2025
Security Bulletin ID
SB2025082843
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use-after-free (CVE-ID: CVE-2025-38666)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the DEFINE_RWLOCK(), __aarp_expire(), aarp_purge() and aarp_proxy_probe_network() functions in net/appletalk/aarp.c. A local user can escalate privileges on the system.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/2a6209e4649d45fd85d4193abc481911858ffc6f
- https://git.kernel.org/stable/c/5f02ea0f63dd38c41539ea290fcc1693c73aa8e5
- https://git.kernel.org/stable/c/6c4a92d07b0850342d3becf2e608f805e972467c
- https://git.kernel.org/stable/c/e4f1564c5b699eb89b3040688fd6b4e57922f1f6
- https://git.kernel.org/stable/c/f90b6bb203f3f38bf2b3d976113d51571df9a482