Security readout for executives and security teams
Plain-English summary
A Linux networking flaw allows an SMC socket to be mistaken for a normal Internet socket. Kernel code may then treat a function pointer as data, causing invalid or repeated frees and crashes. The supplied CVSS rates potential confidentiality, integrity, and availability impacts high, but the sources demonstrate kernel faults rather than successful system takeover.
Executive priority
Treat as a high-priority kernel update, especially on shared systems that permit untrusted local code. The local-access requirement reduces immediate remote risk, while possible kernel memory corruption and high CVSS impact justify prompt remediation. Confirm distribution backports before relying on version numbers alone.
Technical view
struct smc_sock reused AF_INET and AF_INET6 without placing struct inet_sock first. At offset 784, code interpreted clcsk_data_ready as inet_opt, causing CIPSO, NetLabel, and Smack paths to free a text-segment address and trigger double-free warnings or oopses. The stable fix embeds inet_sock first, correcting the underlying layout confusion.
Likely exposure
The bundle marks Linux 6.11, 6.12.40, 6.15.8, and 6.16 affected; it also contains an ambiguous "0" version entry. Practical exposure requires a vulnerable kernel and local low-privilege access. The supplied sources do not fully specify configuration prerequisites, distribution backports, or whether SMC must be enabled or used.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. The supplied record is not in KEV and provides no evidence of active exploitation. Syzbot demonstrated kernel faults, including double-free behavior, but the bundle does not establish a public weaponized exploit or reliable privilege escalation.
Researcher notes
The demonstrated root cause is object-layout type confusion, not faulty CIPSO cleanup. smc_sock hijacked Internet address families while lacking inet_sock at its beginning. Consequently, identical offsets represented incompatible fields. The fix changes structure layout to restore INET assumptions. The supplied excerpt is truncated, so trigger boundaries and exploitability beyond observed crashes remain incomplete.
Mitigation direction
- Update affected systems to a vendor-supported kernel containing the applicable cited stable fix.
- Follow Linux distribution guidance for backported packages and required reboot procedures.
- Restrict untrusted local code execution until patched where exposure cannot be ruled out.
Validation and detection
- Inventory running and installed kernel versions; compare them with affected releases in the CVE record.
- Confirm the installed package includes the applicable stable fix commit or documented vendor backport.
- Reboot after updating and verify the fixed kernel is active.
- Review kernel logs for SMC-related oopses, double-free warnings, or similar fault traces.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38475 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5b02e397929e5b13b969ef1f8e43c7951e2864f5CVE reference, Linux
- https://git.kernel.org/stable/c/67a167a6b8b45607bc34aa541d1c75097d18d460CVE reference, Linux
- https://git.kernel.org/stable/c/60ada4fe644edaa6c2da97364184b0425e8aeaf5CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.