CVE-2025-37838: linux kernel Use-After-Free — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition In the ssi_protocol_probe() function, &ssi->work is bound with ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function within the ssip_pn_ops structure is capable of starting the work. If we remove the module which will call ssi_protocol_remove() to make a cleanup, it will free ssi through kfree(ssi), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | ssip_xmit_work ssi_protocol_remove | kfree(ssi); | | struct hsi_client *cl = ssi->cl; | // use ssi Fix it by ensuring that the work is canceled before proceeding with the cleanup in ssi_protocol_remove().

Is your site exposed to CVE-2025-37838?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-416 Use After Free

Affected Products

Vendor	Product	Versions
linux	linux_kernel	< 6.1.135
linux	linux_kernel	6.2 — 6.6.88
linux	linux_kernel	6.7 — 6.12.24
linux	linux_kernel	6.13 — 6.13.12
linux	linux_kernel	6.14 — 6.14.3

References

Advisories & Patches

https://git.kernel.org/stable/c/4b4194c9a7a8f92db39e8e86c85f4fb12ebbec4f https://git.kernel.org/stable/c/58eb29dba712ab0f13af59ca2fe545f5ce360e78 https://git.kernel.org/stable/c/834e602d0cc7c743bfce734fad4a46cefc0f9ab1 https://git.kernel.org/stable/c/ae5a6a0b425e8f76a9f0677e50796e494e89b088 https://git.kernel.org/stable/c/d58493832e284f066e559b8da5ab20c15a2801d3 https://git.kernel.org/stable/c/e3f88665a78045fe35c7669d2926b8d97b892c11

Other References

https://git.kernel.org/stable/c/4a8c29beb8a02b5a0a9d77d608aa14b6f88a6b86 https://git.kernel.org/stable/c/72972552d0d0bfeb2dec5daf343a19018db36ffa https://git.kernel.org/stable/c/d03abc1c2b21324550fa71e12d53e7d3498e0af6 https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Frequently Asked Questions

What is CVE-2025-37838? +

In the Linux kernel, the following vulnerability has been resolved: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition In the ssi_protocol_probe() function, &ssi->work is bound with ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function within the ssip_pn_ops structure is capable of starting the work. If we remove the module which will call ssi_protocol_remove() to make a cleanup, it will free ssi through kfree(ssi), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | ssip_xmit_work ssi_protocol_remove | kfree(ssi); | | struct hsi_client *cl = ssi->cl; | // use ssi Fix it by ensuring that the work is canceled before proceeding with the cleanup in ssi_protocol_remove(). It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2025-37838? +

CVE-2025-37838 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-37838? +

CVE-2025-37838 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-37838? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-55406

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the …

CVE-2026-6040

A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the …

CVE-2026-13713

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the …

CVE-2026-57076

YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in …

CVE-2026-6424

Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system

CVE-2025-24898

rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice …

CVE-2025-37838