CVE-2025-38734
A critical vulnerability in the Linux kernel’s SMC networking code can cause a kernel crash by exploiting a use‑after‑free bug. The flaw is triggered when a socket is closed immediately after being accepted, leading to a null pointer dereference. The issue has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel 6.17 and earlier versions that have not applied the patch. Typical users include system administrators running Linux servers or desktops.
Real-world impact
An attacker could cause a denial of service by crashing the kernel, potentially leading to system downtime. Because the flaw is local and requires no special privileges, any user with access to the system could trigger it.
Why this severity
The CVSS score of 9.8 reflects the high impact of a complete denial of service, the lack of required privileges, and the fact that the vulnerability can be triggered without user interaction.
What to do about it
- 01Verify the current kernel version using `uname -r`.
- 02If the kernel is older than 6.17, upgrade to Linux kernel 6.17 or later using your distribution’s package manager or by compiling a newer kernel.
- 03Reboot the system to load the updated kernel.
NVD description indicates the issue has been resolved in the kernel
Timeline
- Sep 5, 2025 · Sep 5, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.