CVE-2025-38236

Linux kernel versions 6.9 and earlier, including versions prior to 6.1.143, 6.6.96, 6.12.36, and 6.15.5.

The Linux kernel contains a use-after-free vulnerability in the af unix module, specifically within the unix stream read generic() function. This flaw can be triggered by sending crafted AF UNIX socket messages, potentially allowing a local attacker to achieve privilege escalation and bypass the Chrome sandbox. The vulnerability occurs when handling out-of-band (OOB) data, where consecutive consumed OOB skbs are not properly managed, leading to memory corruption. A proof-of-concept exploit is publicly available.

Upgrade to Linux kernel version 6.1.143 or later. Upgrade to Linux kernel version 6.6.96 or later. Upgrade to Linux kernel version 6.12.36 or later. Upgrade to Linux kernel version 6.15.5 or later. Upgrade to Linux kernel version 6.6.101 or later.