CVE-2025-38212

Root

Cause

The vulnerability resides in the Linux kernel's IPC subsystem, specifically in the shm_destroy_orphaned() function. The function uses idr_for_each() to iterate over shared memory segments, but this iteration was only protected by a read-write semaphore (rwsem) and not by an RCU read-critical section. As a result, when idr_for_each() triggers radix_tree_node_free() via call_rcu(), the radix tree node can be freed immediately, leading to a use-after-free condition when the next node is accessed [1][2].

Exploitation

An attacker with local access to the system can trigger this bug by creating and destroying orphaned shared memory segments in a specific sequence. No special privileges beyond the ability to create IPC objects are required, making the attack surface relatively broad. The race condition occurs during the cleanup of orphaned segments, which can be induced by normal system operations or crafted by an unprivileged user [1].

Impact

Successful exploitation results in a use-after-free, which can be leveraged to corrupt kernel memory. This could lead to a denial of service (system crash) or, in more sophisticated attacks, local privilege escalation to gain root access. The vulnerability has been assigned a CVSS v3 score of 7.8 (High), reflecting the potential for complete compromise of confidentiality, integrity, and availability [1].

Mitigation

The Linux kernel has addressed this issue by adding an RCU read-critical section around the idr_for_each() call in shm_destroy_orphaned(). Patches have been backported to stable kernel versions [2][3][4]. Siemens has confirmed that SIMATIC S7-1500 CPU family devices are affected and recommends applying the available firmware updates [1]. Users should update their kernels to the latest stable release to mitigate the risk.