cve 2025 38236

CVE-2025-38236 is a use-after-free vulnerability in the Linux kernel's AF_UNIX socket handling code. Microsoft's advisory confirms that Azure Linux (the Azure Linux Distribution) is potentially affected because it ships the upstream component containing the bug. Microsoft has begun publishing machine-readable CSAF/VEX attestations for Azure Linux as part of a phased rollout starting in October 2025, and will update CVE mappings if other Microsoft products are later found to include the same vulnerable code. This tag covers discussions about the vulnerability, its impact on Azure Linux, and guidance for applying the kernel patch.