CVE-2025-38734

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free (UAF) vulnerability exists in the net/smc module of the Linux kernel. The issue occurs because newclcsock->sk can become NULL after smc listen out connected() releases the smcsk. This can happen if a user space application closes the socket immediately after accepting a connection, leading to a null pointer dereference when SMC STAT SERV SUCC INC() is called. The vulnerability was identified through BPF CI testing, which reported a kernel NULL pointer dereference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.