{"id":"CVE-2025-38079","title":"crypto: algif_hash - fix double free in hash_accept","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_hash - fix double free in hash_accept\n\nIf accept(2) is called on socket type algif_hash with\nMSG_MORE flag set and crypto_ahash_import fails,\nsk2 is freed…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < 5bff312b59b3f2a54ff504e4f4e47272b64f3633","Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < bf7bba75b91539e93615f560893a599c1e1c98bf","Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < c3059d58f79fdfb2201249c2741514e34562b547","Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < f0f3d09f53534ea385d55ced408f2b67059b16e4","Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < 134daaba93193df9e988524b5cd2f52d15eb1993","Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < 2f45a8d64fb4ed4830a4b3273834ecd6ca504896","Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < 0346f4b742345d1c733c977f3a7aef5a6419a967","Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < b2df03ed4052e97126267e8c13ad4204ea6ba9b6","Linux 2.6.38"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-06-10T20:41:20.938858Z"},"published":"2025-06-18","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:06:29.165Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38079","references":[{"url":"https://git.kernel.org/stable/c/5bff312b59b3f2a54ff504e4f4e47272b64f3633"},{"url":"https://git.kernel.org/stable/c/bf7bba75b91539e93615f560893a599c1e1c98bf"},{"url":"https://git.kernel.org/stable/c/c3059d58f79fdfb2201249c2741514e34562b547"},{"url":"https://git.kernel.org/stable/c/f0f3d09f53534ea385d55ced408f2b67059b16e4"},{"url":"https://git.kernel.org/stable/c/134daaba93193df9e988524b5cd2f52d15eb1993"},{"url":"https://git.kernel.org/stable/c/2f45a8d64fb4ed4830a4b3273834ecd6ca504896"},{"url":"https://git.kernel.org/stable/c/0346f4b742345d1c733c977f3a7aef5a6419a967"},{"url":"https://git.kernel.org/stable/c/b2df03ed4052e97126267e8c13ad4204ea6ba9b6"}],"tags":["cve.org"],"epss":0.00215,"epssPercentile":0.11863,"ingestedAt":"2026-10-15T05:52:46.096Z","slug":"CVE-2025-38079","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_hash - fix double free in hash_accept\n\nIf accept(2) is called on socket type algif_hash with\nMSG_MORE flag set and crypto_ahash_import fails,\nsk2 is freed. However, it is also freed in af_alg_release,\nleading to slab-use-after-free error.\n\n## Affected\n\n- `Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < 5bff312b59b3f2a54ff504e4f4e47272b64f3633`\n- `Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < bf7bba75b91539e93615f560893a599c1e1c98bf`\n- `Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < c3059d58f79fdfb2201249c2741514e34562b547`\n- `Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < f0f3d09f53534ea385d55ced408f2b67059b16e4`\n- `Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < 134daaba93193df9e988524b5cd2f52d15eb1993`\n- `Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < 2f45a8d64fb4ed4830a4b3273834ecd6ca504896`\n- `Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < 0346f4b742345d1c733c977f3a7aef5a6419a967`\n- `Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < b2df03ed4052e97126267e8c13ad4204ea6ba9b6`\n- `Linux 2.6.38`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}