Use-after-free in Linux kernel - CVE-2025-38224

Vulnerability identifier: #VU112287

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-38224

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the kvaser_pciefd_setup_can_ctrls() function in drivers/net/can/kvaser_pciefd.c. A local user can escalate privileges on the system.

Linux kernel
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap
Ubuntu
dlm-kmp-preempt
dtb-marvell
ocfs2-kmp-64kb-debuginfo
dtb-socionext
kselftests-kmp-64kb-debuginfo
gfs2-kmp-64kb
reiserfs-kmp-64kb
dtb-altera
dtb-aarch64
kernel-zfcpdump-debugsource
kernel-zfcpdump-debuginfo
kernel-zfcpdump
kernel-preempt
kselftests-kmp-preempt
gfs2-kmp-preempt
dtb-xilinx
cluster-md-kmp-preempt-debuginfo
kernel-preempt-debuginfo
kselftests-kmp-preempt-debuginfo
reiserfs-kmp-preempt-debuginfo
kernel-preempt-debugsource
gfs2-kmp-preempt-debuginfo
kernel-preempt-devel-debuginfo
kernel-preempt-extra-debuginfo
ocfs2-kmp-preempt-debuginfo
kernel-preempt-optional-debuginfo
kernel-preempt-optional
cluster-md-kmp-preempt
kernel-preempt-extra
dtb-mediatek
dlm-kmp-64kb-debuginfo
dtb-renesas
dtb-freescale
dtb-exynos
kernel-64kb-devel
dtb-amlogic
kernel-64kb-extra-debuginfo
dlm-kmp-64kb
cluster-md-kmp-64kb
cluster-md-kmp-64kb-debuginfo
dtb-hisilicon
kernel-64kb-optional-debuginfo
dtb-nvidia
kernel-preempt-devel
dtb-amd
ocfs2-kmp-64kb
kernel-64kb-devel-debuginfo
kernel-64kb-debuginfo
dtb-apm
dtb-broadcom
kernel-64kb-optional
kselftests-kmp-64kb
gfs2-kmp-64kb-debuginfo
dtb-sprd
kernel-64kb-extra
dtb-zte
dtb-cavium
kernel-macros
kernel-default-debuginfo
kernel-default-devel-debuginfo
reiserfs-kmp-default
reiserfs-kmp-default-debuginfo
gfs2-kmp-default
kernel-obs-qa
kernel-default-optional-debuginfo
kernel-obs-build-debugsource
kernel-obs-build
dlm-kmp-default
ocfs2-kmp-default
kernel-docs-html
kernel-devel
reiserfs-kmp-preempt
kernel-source-vanilla
kernel-source
kernel-docs
dtb-arm
dtb-allwinner
kernel-64kb-debugsource
dtb-qcom
dtb-lg
dtb-al
dtb-rockchip
reiserfs-kmp-64kb-debuginfo
kernel-64kb
ocfs2-kmp-default-debuginfo
dlm-kmp-preempt-debuginfo
ocfs2-kmp-preempt
kernel-kvmsmall-devel
kernel-kvmsmall-debuginfo
kernel-kvmsmall-devel-debuginfo
kernel-kvmsmall-debugsource
kernel-kvmsmall
kernel-default-livepatch-devel
kernel-default
kernel-syms
kernel-default-devel
kernel-default-debugsource
cluster-md-kmp-default-debuginfo
kernel-default-optional
gfs2-kmp-default-debuginfo
kselftests-kmp-default-debuginfo
kernel-default-extra
dlm-kmp-default-debuginfo
kselftests-kmp-default
kernel-default-extra-debuginfo
kernel-default-livepatch
cluster-md-kmp-default
kernel-default-base
kernel-default-base-rebuild
kernel-source-rt
kernel-rt
kernel-rt-debugsource
kernel-rt-debuginfo
linux (Ubuntu package)
linux-hwe-6.14 (Ubuntu package)
linux-azure (Ubuntu package)
linux-realtime-6.14 (Ubuntu package)
linux-aws-6.14 (Ubuntu package)
linux-gcp-6.14 (Ubuntu package)

Install update from vendor's repository.

dlm-kmp-preempt - update to 5.3.18-150300.59.238.1
dtb-marvell - update to 5.3.18-150300.59.238.1
ocfs2-kmp-64kb-debuginfo - update to 5.3.18-150300.59.238.1
dtb-socionext - update to 5.3.18-150300.59.238.1
kselftests-kmp-64kb-debuginfo - update to 5.3.18-150300.59.238.1
gfs2-kmp-64kb - update to 5.3.18-150300.59.238.1
reiserfs-kmp-64kb - update to 5.3.18-150300.59.238.1
dtb-altera - update to 5.3.18-150300.59.238.1
dtb-aarch64 - update to 5.3.18-150300.59.238.1
kernel-zfcpdump-debugsource - update to 5.3.18-150300.59.238.1
kernel-zfcpdump-debuginfo - update to 5.3.18-150300.59.238.1
kernel-zfcpdump - update to 5.3.18-150300.59.238.1
kernel-preempt - update to 5.3.18-150300.59.238.1
kselftests-kmp-preempt - update to 5.3.18-150300.59.238.1
gfs2-kmp-preempt - update to 5.3.18-150300.59.238.1
dtb-xilinx - update to 5.3.18-150300.59.238.1
cluster-md-kmp-preempt-debuginfo - update to 5.3.18-150300.59.238.1
kernel-preempt-debuginfo - update to 5.3.18-150300.59.238.1
kselftests-kmp-preempt-debuginfo - update to 5.3.18-150300.59.238.1
reiserfs-kmp-preempt-debuginfo - update to 5.3.18-150300.59.238.1
kernel-preempt-debugsource - update to 5.3.18-150300.59.238.1
gfs2-kmp-preempt-debuginfo - update to 5.3.18-150300.59.238.1
kernel-preempt-devel-debuginfo - update to 5.3.18-150300.59.238.1
kernel-preempt-extra-debuginfo - update to 5.3.18-150300.59.238.1
ocfs2-kmp-preempt-debuginfo - update to 5.3.18-150300.59.238.1
kernel-preempt-optional-debuginfo - update to 5.3.18-150300.59.238.1
kernel-preempt-optional - update to 5.3.18-150300.59.238.1
cluster-md-kmp-preempt - update to 5.3.18-150300.59.238.1
kernel-preempt-extra - update to 5.3.18-150300.59.238.1
dtb-mediatek - update to 5.3.18-150300.59.238.1
dlm-kmp-64kb-debuginfo - update to 5.3.18-150300.59.238.1
dtb-renesas - update to 5.3.18-150300.59.238.1
dtb-freescale - update to 5.3.18-150300.59.238.1
dtb-exynos - update to 5.3.18-150300.59.238.1
kernel-64kb-devel - update to 5.3.18-150300.59.238.1
dtb-amlogic - update to 5.3.18-150300.59.238.1
kernel-64kb-extra-debuginfo - update to 5.3.18-150300.59.238.1
dlm-kmp-64kb - update to 5.3.18-150300.59.238.1
cluster-md-kmp-64kb - update to 5.3.18-150300.59.238.1
cluster-md-kmp-64kb-debuginfo - update to 5.3.18-150300.59.238.1
dtb-hisilicon - update to 5.3.18-150300.59.238.1
kernel-64kb-optional-debuginfo - update to 5.3.18-150300.59.238.1
dtb-nvidia - update to 5.3.18-150300.59.238.1
kernel-preempt-devel - update to 5.3.18-150300.59.238.1
dtb-amd - update to 5.3.18-150300.59.238.1
ocfs2-kmp-64kb - update to 5.3.18-150300.59.238.1
kernel-64kb-devel-debuginfo - update to 5.3.18-150300.59.238.1
kernel-64kb-debuginfo - update to 5.3.18-150300.59.238.1
dtb-apm - update to 5.3.18-150300.59.238.1
dtb-broadcom - update to 5.3.18-150300.59.238.1
kernel-64kb-optional - update to 5.3.18-150300.59.238.1
kselftests-kmp-64kb - update to 5.3.18-150300.59.238.1
gfs2-kmp-64kb-debuginfo - update to 5.3.18-150300.59.238.1
dtb-sprd - update to 5.3.18-150300.59.238.1
kernel-64kb-extra - update to 5.3.18-150300.59.238.1
dtb-zte - update to 5.3.18-150300.59.238.1
dtb-cavium - update to 5.3.18-150300.59.238.1
kernel-macros - update to 5.3.18-150300.59.238.1
kernel-default-debuginfo - update to 5.3.18-150300.59.238.1
kernel-default-devel-debuginfo - update to 5.3.18-150300.59.238.1
reiserfs-kmp-default - update to 5.3.18-150300.59.238.1
reiserfs-kmp-default-debuginfo - update to 5.3.18-150300.59.238.1
gfs2-kmp-default - update to 5.3.18-150300.59.238.1
kernel-obs-qa - update to 5.3.18-150300.59.238.1
kernel-default-optional-debuginfo - update to 5.3.18-150300.59.238.1
kernel-obs-build-debugsource - update to 5.3.18-150300.59.238.1
kernel-obs-build - update to 5.3.18-150300.59.238.1
dlm-kmp-default - update to 5.3.18-150300.59.238.1
ocfs2-kmp-default - update to 5.3.18-150300.59.238.1
kernel-docs-html - update to 5.3.18-150300.59.238.1
kernel-devel - update to 5.3.18-150300.59.238.1
reiserfs-kmp-preempt - update to 5.3.18-150300.59.238.1
kernel-source-vanilla - update to 5.3.18-150300.59.238.1
kernel-source - update to 5.3.18-150300.59.238.1
kernel-docs - update to 5.3.18-150300.59.238.1
dtb-arm - update to 5.3.18-150300.59.238.1
dtb-allwinner - update to 5.3.18-150300.59.238.1
kernel-64kb-debugsource - update to 5.3.18-150300.59.238.1
dtb-qcom - update to 5.3.18-150300.59.238.1
dtb-lg - update to 5.3.18-150300.59.238.1
dtb-al - update to 5.3.18-150300.59.238.1
dtb-rockchip - update to 5.3.18-150300.59.238.1
reiserfs-kmp-64kb-debuginfo - update to 5.3.18-150300.59.238.1
kernel-64kb - update to 5.3.18-150300.59.238.1
ocfs2-kmp-default-debuginfo - update to 5.3.18-150300.59.238.1
dlm-kmp-preempt-debuginfo - update to 5.3.18-150300.59.238.1
ocfs2-kmp-preempt - update to 5.3.18-150300.59.238.1
kernel-kvmsmall-devel - update to 5.3.18-150300.59.238.1
kernel-kvmsmall-debuginfo - update to 5.3.18-150300.59.238.1
kernel-kvmsmall-devel-debuginfo - update to 5.3.18-150300.59.238.1
kernel-kvmsmall-debugsource - update to 5.3.18-150300.59.238.1
kernel-kvmsmall - update to 5.3.18-150300.59.238.1
kernel-default-livepatch-devel - update to 5.3.18-150300.59.238.1
kernel-default - update to 5.3.18-150300.59.238.1
kernel-syms - update to 5.3.18-150300.59.238.1
kernel-default-devel - update to 5.3.18-150300.59.238.1
kernel-default-debugsource - update to 5.3.18-150300.59.238.1
cluster-md-kmp-default-debuginfo - update to 5.3.18-150300.59.238.1
kernel-default-optional - update to 5.3.18-150300.59.238.1
gfs2-kmp-default-debuginfo - update to 5.3.18-150300.59.238.1
kselftests-kmp-default-debuginfo - update to 5.3.18-150300.59.238.1
kernel-default-extra - update to 5.3.18-150300.59.238.1
dlm-kmp-default-debuginfo - update to 5.3.18-150300.59.238.1
kselftests-kmp-default - update to 5.3.18-150300.59.238.1
kernel-default-extra-debuginfo - update to 5.3.18-150300.59.238.1
kernel-default-livepatch - update to 5.3.18-150300.59.238.1
cluster-md-kmp-default - update to 5.3.18-150300.59.238.1
kernel-default-base - update to 5.3.18-150300.59.238.1.150300.18.142.1
kernel-default-base-rebuild - update to 5.3.18-150300.59.238.1.150300.18.142.1
kernel-source-rt - update to 5.3.18-150300.238.1
kernel-rt - update to 5.3.18-150300.238.1
kernel-rt-debugsource - update to 5.3.18-150300.238.1
kernel-rt-debuginfo - update to 5.3.18-150300.238.1
linux (Ubuntu package) - addressed in versions 6.14.0-34.34, 6.14.0-1014.14~24.04.1, 6.14.0-1015.15, 6.14.0-1015.15~24.04.1, 6.14.0-1016.16, 6.14.0-1018.19
linux-hwe-6.14 (Ubuntu package) - update to 6.14.0-34.34~24.04.1
linux-azure (Ubuntu package) - addressed in versions 6.14.0-1007.7+25.10.1, 6.14.0-1014.14, 6.14.0-1014.14~24.04.1
linux-realtime-6.14 (Ubuntu package) - update to 6.14.0-1014.14~24.04.1
linux-aws-6.14 (Ubuntu package) - update to 6.14.0-1015.15~24.04.1
linux-gcp-6.14 (Ubuntu package) - update to 6.14.0-1018.19~24.04.1

• https://git.kernel.org/stable/c/54ec8b08216f3be2cc98b33633d3c8ea79749895
• https://git.kernel.org/stable/c/a6550c9aa11e2f57f9cdaa6249cdd44d446be874
• https://git.kernel.org/stable/c/d8a054b6e6824a8b52c3977ebd38c9583a63efac

• Use-after-free in Linux kernel net can driver
• Ubuntu update for linux-realtime-6.14
• Ubuntu update for linux-azure
• Ubuntu update for linux
• Ubuntu update for linux-aws-6.14
• Ubuntu update for linux-gcp-6.14
• Ubuntu update for linux-hwe-6.14
• SUSE update for the Linux Kernel
• SUSE update for the Linux Kernel