CVE-2025-38129

CVE-2025-38129 is a use-after-free vulnerability in the Linux kernel's page_pool subsystem, specifically within the page_pool_recycle_in_ring function. This flaw allows for memory corruption due to a race condition where the page_pool can be freed while pages are still being recycled, leading to an attempt to access freed memory. It affects various Linux kernel versions, as indicated by the numerous security updates from vendors like Ubuntu and SUSE. Rated with a CVSS score of 7.8 (High), this vulnerability has a local attack vector with low attack complexity, requiring local user privileges. A successful exploit could lead to high confidentiality, integrity, and availability impacts, potentially allowing for privilege escalation or denial of service. The root cause is the lack of a proper barrier to prevent the page_pool from being freed before all pages are recycled. Currently, there is no public exploit code available for CVE-2025-38129, and it is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Despite the absence of active exploitation, the vulnerability has garnered significant community discussion and media coverage, indicating its importance and the attention it has received from security researchers and vendors.