Use After Free Vulnerability in Linux Kernel Tun Driver

CVE-2025-39984

What is CVE-2025-39984?

A use-after-free vulnerability exists in the Linux kernel's tun driver, specifically during the handling of network packets processed by the XDP (Express Data Path). When the XDP program is attached, an original socket buffer (skb) may be freed prematurely, while the napi structure still references it, leading to potential instability or compromise. The issue arises when the skb is cleared, but the napi's reference is not updated accordingly, which could allow malicious actors to exploit the freed memory, resulting in security risks.

References