Use-After-Free Vulnerability in Linux Kernel Affecting Asynchronous Crypto Handling

CVE-2025-38488

What is CVE-2025-38488?

A use-after-free vulnerability exists in the Linux kernel's crypt_message function when utilizing asynchronous crypto operations with hardware accelerators. This flaw arises due to the improper handling of memory allocation when async encryption operations are initiated. If a hardware crypto accelerator indicates that an operation is in progress, the system frees the memory buffer allocated for the request too early, resulting in potential kernel crashes due to accessing freed memory. The vulnerability highlights the need for restoring proper asynchronous handling procedures to ensure memory safety and maintain system stability.

References