TLDR Tech / InfoSec
A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets
CVE-2025-38617 is a 20-year-old use-after-free in the Linux kernel's AF_PACKET subsystem (net/packet/af_packet.c), present since Linux 2.6.12 and fixed in 6.16, exploitable by any unprivileged user with CAP_NET_RAW (obtainable via user namespaces) to achieve full privilege escalation and container escape. The root cause is a conditional WRITE_ONCE(po->num, 0) that only zeroes the protocol number when the socket was already running, leaving a window where a NETDEV_UP event can re-register the protocol hook while packet_set_ring() is mid-free. The exploit stretches this nanosecond race to a deterministic one-second window by pre-acquiring pg_vec_lock via a sleeping tpacket_snd() call, then uses a BPF filter delay and a 720,000-entry timerfd wait queue interrupt to win the second race. The resulting five-stage exploit chains a page overflow into simple_xattr corruption, heap read/write via pgv array overlap, arbitrary page read/write through a master-puppet ring buffer pair, KASLR bypass via anon_pipe_buf_ops pointer recovery, and final privilege escalation via syscall patching, defeating both CONFIG_RANDOM_KMALLOC_CACHES and CONFIG_SLAB_VIRTUAL mitigations.
Read the full story