{"id":"DEBIAN-CVE-2025-38129","details":"In the Linux kernel, the following vulnerability has been resolved:  page_pool: Fix use-after-free in page_pool_recycle_in_ring  syzbot reported a uaf in page_pool_recycle_in_ring:  BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 Read of size 8 at addr ffff8880286045a0 by task syz.0.284/6943  CPU: 0 UID: 0 PID: 6943 Comm: syz.0.284 Not tainted 6.13.0-rc3-syzkaller-gdfa94ce54f41 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace:  \u003cTASK\u003e  __dump_stack lib/dump_stack.c:94 [inline]  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120  print_address_description mm/kasan/report.c:378 [inline]  print_report+0x169/0x550 mm/kasan/report.c:489  kasan_report+0x143/0x180 mm/kasan/report.c:602  lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862  __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:165 [inline]  _raw_spin_unlock_bh+0x1b/0x40 kernel/locking/spinlock.c:210  spin_unlock_bh include/linux/spinlock.h:396 [inline]  ptr_ring_produce_bh include/linux/ptr_ring.h:164 [inline]  page_pool_recycle_in_ring net/core/page_pool.c:707 [inline]  page_pool_put_unrefed_netmem+0x748/0xb00 net/core/page_pool.c:826  page_pool_put_netmem include/net/page_pool/helpers.h:323 [inline]  page_pool_put_full_netmem include/net/page_pool/helpers.h:353 [inline]  napi_pp_put_page+0x149/0x2b0 net/core/skbuff.c:1036  skb_pp_recycle net/core/skbuff.c:1047 [inline]  skb_free_head net/core/skbuff.c:1094 [inline]  skb_release_data+0x6c4/0x8a0 net/core/skbuff.c:1125  skb_release_all net/core/skbuff.c:1190 [inline]  __kfree_skb net/core/skbuff.c:1204 [inline]  sk_skb_reason_drop+0x1c9/0x380 net/core/skbuff.c:1242  kfree_skb_reason include/linux/skbuff.h:1263 [inline]  __skb_queue_purge_reason include/linux/skbuff.h:3343 [inline]  root cause is:  page_pool_recycle_in_ring   ptr_ring_produce     spin_lock(&r-\u003eproducer_lock);     WRITE_ONCE(r-\u003equeue[r-\u003eproducer++], ptr)       //recycle last page to pool \t\t\t\tpage_pool_release \t\t\t\t  page_pool_scrub \t\t\t\t    page_pool_empty_ring \t\t\t\t      ptr_ring_consume \t\t\t\t      page_pool_return_page  //release all page \t\t\t\t  __page_pool_destroy \t\t\t\t     free_percpu(pool-\u003erecycle_stats); \t\t\t\t     free(pool) //free       spin_unlock(&r-\u003eproducer_lock); //pool-\u003ering uaf read   recycle_stat_inc(pool, ring);  page_pool can be free while page pool recycle the last page in ring. Add producer-lock barrier to page_pool_release to prevent the page pool from being free before all pages have been recycled.  recycle_stat_inc() is empty when CONFIG_PAGE_POOL_STATS is not enabled, which will trigger Wempty-body build warning. Add definition for pool stat macro to fix warning.","modified":"2026-09-01T16:06:13.843253256Z","published":"2025-07-03T09:15:27.170Z","upstream":["CVE-2025-38129"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-38129"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.162-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.153-1","6.1.158-1","6.1.159-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38129.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.35-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38129.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.35-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38129.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}