{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38375","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T04:51:24.009Z","datePublished":"2025-07-25T12:53:17.629Z","dateUpdated":"2026-08-05T12:01:26.660Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:01:26.660Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: ensure the received length does not exceed allocated size\n\nIn xdp_linearize_page, when reading the following buffers from the ring,\nwe forget to check the received length with the true allocate size. This\ncan lead to an out-of-bound read. This commit adds that missing check."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The attacker-controlled value is the used-ring length written by the virtio backend (hypervisor/VMM, vhost-user daemon, VDUSE device, or vDPA hardware), not anything carried in received network packets, so a remote peer cannot reach it. The attack is delivered over the local paravirtual transport, matching kernel CNA precedent for virtio device-supplied-length bugs (CVE-2026-64456, CVE-2026-46123).\nAC:L - The backend fully and deterministically controls both `hdr->num_buffers` and the used-ring `len`, with no race to win and no memory-layout guessing required; a single crafted RX completion triggers it every time. XDP attachment is a target configuration the backend can observe via the guest's headroom/GSO renegotiation, not an uncontrollable condition.\nPR:N - The malicious backend needs no credentials, account, or capability inside the victim guest — it simply completes a receive buffer with a bogus length. This matches the PR:N scoring used for the equivalent virtio_bt and hwrng-virtio device-length CVEs.\nUI:N - Triggering requires only that the driver process an RX completion in NAPI/softirq context, which happens automatically. No victim action of any kind is needed.\nS:U - The vulnerable component and the impacted component are both the virtio_net driver's own kernel, and a host-to-guest attack does not gain the attacker authority it did not already hold. This is not a guest-to-host escape or an IOMMU/DMA boundary bypass.\nC:H - Each malformed completion copies up to ~3.5 KB of adjacent kernel memory into the linearized packet, which the XDP program can then XDP_TX/XDP_REDIRECT back to the attacker or which reaches userspace via a socket, giving a repeatable kernel memory disclosure channel. The integer-overflow variant extends the read arbitrarily far past the source buffer.\nI:H - The `page_off + buflen + tailroom > PAGE_SIZE` guard is defeated by unsigned wraparound (verified: `buflen = 0xFFFFFD5C` makes the sum evaluate to 0), so the memcpy writes gigabytes beyond the single-page destination, corrupting arbitrary kernel heap memory. That is an out-of-bounds write, not merely the out-of-bounds read named in the commit message.\nA:H - Reading past the end of the source page, or the multi-gigabyte memcpy from the overflow variant, faults in softirq context and oopses/panics the kernel, and is instantly reproducible under KASAN or DEBUG_PAGEALLOC. The wholesale kernel memory corruption makes a crash the expected outcome."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/virtio_net.c"],"versions":[{"version":"4941d472bf95b4345d6e38906fcf354e74afa311","lessThan":"773e95c268b5d859f51f7547559734fd2a57660c","status":"affected","versionType":"git"},{"version":"4941d472bf95b4345d6e38906fcf354e74afa311","lessThan":"ddc8649d363141fb3371dd81a73e1cb4ef8ed1e1","status":"affected","versionType":"git"},{"version":"4941d472bf95b4345d6e38906fcf354e74afa311","lessThan":"982beb7582c193544eb9c6083937ec5ac1c9d651","status":"affected","versionType":"git"},{"version":"4941d472bf95b4345d6e38906fcf354e74afa311","lessThan":"6aca3dad2145e864dfe4d1060f45eb1bac75dd58","status":"affected","versionType":"git"},{"version":"4941d472bf95b4345d6e38906fcf354e74afa311","lessThan":"80b971be4c37a4d23a7f1abc5ff33dc7733d649b","status":"affected","versionType":"git"},{"version":"4941d472bf95b4345d6e38906fcf354e74afa311","lessThan":"bc68bc3563344ccdc57d1961457cdeecab8f81ef","status":"affected","versionType":"git"},{"version":"4941d472bf95b4345d6e38906fcf354e74afa311","lessThan":"11f2d0e8be2b5e784ac45fa3da226492c3e506d8","status":"affected","versionType":"git"},{"version":"4941d472bf95b4345d6e38906fcf354e74afa311","lessThan":"315dbdd7cdf6aa533829774caaf4d25f1fd20e73","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/virtio_net.c"],"versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","status":"unaffected","versionType":"semver"},{"version":"5.4.297","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.241","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.189","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.144","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.97","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.37","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.15.6","lessThanOrEqual":"6.15.*","status":"unaffected","versionType":"semver"},{"version":"6.16","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.4.297"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.10.241"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.15.189"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"6.1.144"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"6.6.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"6.12.37"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"6.15.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"6.16"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/773e95c268b5d859f51f7547559734fd2a57660c"},{"url":"https://git.kernel.org/stable/c/ddc8649d363141fb3371dd81a73e1cb4ef8ed1e1"},{"url":"https://git.kernel.org/stable/c/982beb7582c193544eb9c6083937ec5ac1c9d651"},{"url":"https://git.kernel.org/stable/c/6aca3dad2145e864dfe4d1060f45eb1bac75dd58"},{"url":"https://git.kernel.org/stable/c/80b971be4c37a4d23a7f1abc5ff33dc7733d649b"},{"url":"https://git.kernel.org/stable/c/bc68bc3563344ccdc57d1961457cdeecab8f81ef"},{"url":"https://git.kernel.org/stable/c/11f2d0e8be2b5e784ac45fa3da226492c3e506d8"},{"url":"https://git.kernel.org/stable/c/315dbdd7cdf6aa533829774caaf4d25f1fd20e73"}],"title":"virtio-net: ensure the received length does not exceed allocated size","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T17:37:12.435Z"}}]}}