CVE-2025-38708

Vulnerability

In the Linux kernel's DRBD (Distributed Replicated Block Device) implementation, the handle_write_conflicts function contains a missing kref_get call when processing "superseeded" writes[1][2]. DRBD, with the two-primaries setting enabled, attempts to detect and handle concurrent writes to the same sector from two nodes to ensure data consistency. The missing reference count increment leads to a premature drbd_destroy_device, resulting in a use-after-free condition that manifests as kernel crashes[3][4].

Exploitation

Exploitation requires the DRBD module to be loaded and configured in two-primaries mode. The vulnerable code path is only exercised when a write conflict is detected and a prior write is superseded[1]. According to the upstream commit message and vendor advisories, this scenario is rarely encountered in real-world deployments because upper layers—such as cluster file systems with distributed lock managers or live-migration setups—prevent concurrent writes to the same sector[1][2]. The vulnerability is therefore primarily a concern for test environments or misconfigured systems.

Impact

An attacker who can trigger the specific write conflict condition can cause a use-after-free, leading to a kernel crash (denial of service). The advisory notes that the affected code path is infrequently hit in production, limiting the practical impact[1][2]. No evidence of active exploitation is provided in the sources.

Mitigation

The fix is to add the missing kref_get call, which has been applied in upstream Linux kernel stable commits[3][4]. Users should update their kernel to a version containing these commits. Siemens security advisories list several industrial products (e.g., SIMATIC S7-1500 family, SIMATIC CN 4100) as affected if they incorporate vulnerable kernel versions[1][2]. The advisory recommends following the remediation steps provided by Siemens for those products. No workaround is described besides applying the patch or avoiding the two-primaries configuration with untrusted input.