---
id: CVE-2025-38079
title: 'crypto: algif_hash - fix double free in hash_accept'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  crypto: algif_hash - fix double free in hash_accept

  If accept(2) is called on socket type algif_hash with
  MSG_MORE flag set and crypto_ahash_import fails,
  sk2 is freed…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 <
    5bff312b59b3f2a54ff504e4f4e47272b64f3633
  - >-
    Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 <
    bf7bba75b91539e93615f560893a599c1e1c98bf
  - >-
    Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 <
    c3059d58f79fdfb2201249c2741514e34562b547
  - >-
    Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 <
    f0f3d09f53534ea385d55ced408f2b67059b16e4
  - >-
    Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 <
    134daaba93193df9e988524b5cd2f52d15eb1993
  - >-
    Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 <
    2f45a8d64fb4ed4830a4b3273834ecd6ca504896
  - >-
    Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 <
    0346f4b742345d1c733c977f3a7aef5a6419a967
  - >-
    Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 <
    b2df03ed4052e97126267e8c13ad4204ea6ba9b6
  - Linux 2.6.38
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-10T20:41:20.938858Z'
published: '2025-06-18'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:06:29.165Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38079'
references:
  - url: 'https://git.kernel.org/stable/c/5bff312b59b3f2a54ff504e4f4e47272b64f3633'
  - url: 'https://git.kernel.org/stable/c/bf7bba75b91539e93615f560893a599c1e1c98bf'
  - url: 'https://git.kernel.org/stable/c/c3059d58f79fdfb2201249c2741514e34562b547'
  - url: 'https://git.kernel.org/stable/c/f0f3d09f53534ea385d55ced408f2b67059b16e4'
  - url: 'https://git.kernel.org/stable/c/134daaba93193df9e988524b5cd2f52d15eb1993'
  - url: 'https://git.kernel.org/stable/c/2f45a8d64fb4ed4830a4b3273834ecd6ca504896'
  - url: 'https://git.kernel.org/stable/c/0346f4b742345d1c733c977f3a7aef5a6419a967'
  - url: 'https://git.kernel.org/stable/c/b2df03ed4052e97126267e8c13ad4204ea6ba9b6'
tags:
  - cve.org
epss: 0.00215
epssPercentile: 0.11863
ingestedAt: '2026-10-15T05:52:46.096Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_hash - fix double free in hash_accept

If accept(2) is called on socket type algif_hash with
MSG_MORE flag set and crypto_ahash_import fails,
sk2 is freed. However, it is also freed in af_alg_release,
leading to slab-use-after-free error.

## Affected

- `Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < 5bff312b59b3f2a54ff504e4f4e47272b64f3633`
- `Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < bf7bba75b91539e93615f560893a599c1e1c98bf`
- `Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < c3059d58f79fdfb2201249c2741514e34562b547`
- `Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < f0f3d09f53534ea385d55ced408f2b67059b16e4`
- `Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < 134daaba93193df9e988524b5cd2f52d15eb1993`
- `Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < 2f45a8d64fb4ed4830a4b3273834ecd6ca504896`
- `Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < 0346f4b742345d1c733c977f3a7aef5a6419a967`
- `Linux >= fe869cdb89c95d060c77eea20204d6c91f233b53 < b2df03ed4052e97126267e8c13ad4204ea6ba9b6`
- `Linux 2.6.38`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.