Security readout for executives and security teams
Plain-English summary
A race in Linux Shared Memory Communications can make the kernel access a released socket when an application quickly closes a newly accepted connection. The observed result was a kernel null-pointer fault, creating a serious availability risk. The supplied record rates it critical at CVSS 9.8, although data theft or code execution was not demonstrated.
Executive priority
Prioritize affected SMC servers for prompt patching because a triggered kernel fault could interrupt critical services. Do not infer widespread exposure from the 9.8 score alone: first establish SMC usage and vendor package status. Escalate internet- or untrusted-network-facing SMC workloads.
Technical view
After smc_listen_out_connected() releases the socket lock, userspace can accept and close the connection, clearing newclcsock->sk. smc_listen_work then dereferences that invalid pointer while updating statistics. The stable fixes reorder the affected operations to avoid accessing the socket after the release window.
Likely exposure
Exposure is most relevant to affected Linux kernels running SMC listening workloads. Systems without AF_SMC support or active SMC listeners are likely less exposed. The supplied version data does not map reliably to distributor packages, so kernel package status and vendor backports require separate confirmation.
Exploitation context
The issue was reported by BPF CI and reproduced as a kernel fault during an accept-and-immediate-close race. The source bundle marks KEV false and provides no evidence of active exploitation or a public weaponized exploit. Practical remote controllability is not established by the supplied evidence.
Researcher notes
The reported trace came from a dirty 6.13.0-rc3 QEMU kernel with an out-of-tree unsigned BPF test module. It demonstrates a null dereference in smc_listen_work. Although the record describes a use-after-free and assigns high confidentiality, integrity, and availability impacts, the supplied evidence directly demonstrates only a kernel crash condition.
Mitigation direction
- Install a distributor kernel containing the applicable stable fix, then reboot into that kernel.
- Confirm vendor backport status rather than relying only on displayed kernel version numbers.
- If patching is delayed, disable unused SMC functionality after operational testing and vendor review.
- Restrict reachability of necessary SMC listeners as an interim risk-reduction measure.
- Monitor kernel faults and maintain recovery procedures until remediation is verified.
Validation and detection
- Inventory kernel versions and distributor package revisions across systems.
- Identify hosts with AF_SMC support and applications using SMC listening sockets.
- Confirm the installed kernel includes the applicable stable commit or vendor backport.
- Review kernel logs for faults referencing smc_listen_work or smc_hs_wq.
- Verify systems rebooted into the remediated kernel after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38734 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/070b4af44c4b6e4c35fb1ca7001a6a88fd2d318fCVE reference, Linux
- https://git.kernel.org/stable/c/2e765ba0ee0eae35688b443e97108308a716773eCVE reference, Linux
- https://git.kernel.org/stable/c/85545f1525f9fa9bf44fec77ba011024f15da342CVE reference, Linux
- https://git.kernel.org/stable/c/d9cef55ed49117bd63695446fb84b4b91815c0b4CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.