cve 2025 38097

CVE-2025-38097 is an upstream Linux kernel vulnerability in the espintcp code that removes caching of an encapsulation socket to prevent a reference leak that could block network namespace cleanup. Microsoft has publicly attested that Azure Linux includes the affected open-source library and is therefore potentially impacted, but this is a product-scoped statement and does not confirm whether every Microsoft product is affected. Discussions on WindowsForum.com clarify the scope of the vulnerability, emphasizing that the Microsoft attestation applies specifically to Azure Linux and should not be generalized to all Microsoft offerings without further verification.