In the Linux kernel, the following vulnerability has been resolved:
net: appletalk: Fix use-after-free in AARP proxy probe
The AARP proxyâprobe routine (aarpproxyprobenetwork) sends a probe, releases the aarplock, sleeps, then re-acquires the lock. During that window an expire timer thread (__aarpexpiretimer) can remove and kfree() the same entry, leading to a use-after-free.
race condition:
cpu 0 | cpu 1
atalk_sendmsg() | atif_proxy_probe_device()
aarp_send_ddp() | aarp_proxy_probe_network()
mod_timer() | lock(aarp_lock) // LOCK!!
timeout around 200ms | alloc(aarp_entry)
and then call | proxies[hash] = aarp_entry
aarp_expire_timeout() | aarp_send_probe()
| unlock(aarp_lock) // UNLOCK!!
lock(aarp_lock) // LOCK!! | msleep(100);
__aarp_expire_timer(&proxies[ct]) |
free(aarp_entry) |
unlock(aarp_lock) // UNLOCK!! |
| lock(aarp_lock) // LOCK!!
| UAF aarp_entry !!
================================================================== BUG: KASAN: slab-use-after-free in aarpproxyprobe_network+0x560/0x630 net/appletalk/aarp.c:493 Read of size 4 at addr ffff8880123aa360 by task repro/13278
CPU: 3 UID: 0 PID: 13278 Comm: repro Not tainted 6.15.2 #3 PREEMPT(full) Call Trace: <TASK> __dumpstack lib/dumpstack.c:94 [inline] dump_stacklvl+0x116/0x1b0 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:408 [inline] printreport+0xc1/0x630 mm/kasan/report.c:521 kasanreport+0xca/0x100 mm/kasan/report.c:634 aarpproxyprobenetwork+0x560/0x630 net/appletalk/aarp.c:493 atifproxyprobedevice net/appletalk/ddp.c:332 [inline] atifioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 atalkioctl+0x198/0x2f0 net/appletalk/ddp.c:1818 sockdoioctl+0xdc/0x260 net/socket.c:1190 sockioctl+0x239/0x6a0 net/socket.c:1311 vfsioctl fs/ioctl.c:51 [inline] __dosysioctl fs/ioctl.c:906 [inline] __sesysioctl fs/ioctl.c:892 [inline] __x64sysioctl+0x194/0x200 fs/ioctl.c:892 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xcb/0x250 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f </TASK>
Allocated: aarpalloc net/appletalk/aarp.c:382 [inline] aarpproxyprobenetwork+0xd8/0x630 net/appletalk/aarp.c:468 atifproxyprobedevice net/appletalk/ddp.c:332 [inline] atifioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818
Freed: kfree+0x148/0x4d0 mm/slub.c:4841 __aarp_expire net/appletalk/aarp.c:90 [inline] __aarpexpiretimer net/appletalk/aarp.c:261 [inline] aarpexpiretimeout+0x480/0x6e0 net/appletalk/aarp.c:317
The buggy address belongs to the object at ffff8880123aa300 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 96 bytes inside of freed 192-byte region [ffff8880123aa300, ffff8880123aa3c0)
Memory state around the buggy address: ffff8880123aa200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880123aa280: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880123aa300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880123aa380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8880123aa400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38666.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38666.json"
[
{
"signature_version": "v1",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_alloc"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f02ea0f63dd38c41539ea290fcc1693c73aa8e5",
"deprecated": false,
"digest": {
"function_hash": "273577078198146005587710424504775957257",
"length": 157.0
},
"id": "CVE-2025-38666-47a40018",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/appletalk/aarp.c",
"function": "aarp_proxy_probe_network"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f02ea0f63dd38c41539ea290fcc1693c73aa8e5",
"deprecated": false,
"digest": {
"function_hash": "14660294563874566865754199465454365850",
"length": 1001.0
},
"id": "CVE-2025-38666-6f2e1bdb",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/appletalk/aarp.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f02ea0f63dd38c41539ea290fcc1693c73aa8e5",
"deprecated": false,
"digest": {
"line_hashes": [
"73854990650700581868678392597181926646",
"263303934906244969492656116273746606367",
"200884772068156373394057522350610049293",
"163084269581594057276739236106591127978",
"216495261570935422834873764371186102979",
"279397528589569221729858028047705484060",
"180027262036980093018403653948546520078",
"129404743141437446170204429883748330787",
"319669574524256283827147139203221193288",
"97978373482137096330915800241991792561",
"72474082752636521865967004360336809646",
"240119635759487087803777011158487277275",
"304197330181340102458894783057954339787",
"93214540177594444906051492912543926126",
"229719616580827340883150016063601463139",
"1116079169046935464483898028063167908",
"179707877475520199201259944704476963255",
"156261536345107652362924349752541376952",
"323305606234630414280061400136887174894",
"269641696223797824104137154422300274051",
"45626868918861249996839155811922354794",
"148559629402009255648760956588614658158",
"16537974276516467229010094575779824734",
"217316264596944149682871359500987344654",
"304428554886377331385924044876703443175",
"174204708076407221909548189426200278855",
"98643044313704146644431276130602401824",
"100301250077684177536773056645678580846"
],
"threshold": 0.9
},
"id": "CVE-2025-38666-a0aa64c2",
"signature_type": "Line"
}
]