{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38532","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T04:51:24.023Z","datePublished":"2025-08-16T11:12:25.161Z","dateUpdated":"2026-08-05T12:02:42.423Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:02:42.423Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: libwx: properly reset Rx ring descriptor\n\nWhen device reset is triggered by feature changes such as toggling Rx\nVLAN offload, wx->do_reset() is called to reinitialize Rx rings. The\nhardware descriptor ring may retain stale values from previous sessions.\nAnd only set the length to 0 in rx_desc[0] would result in building\nmalformed SKBs. Fix it to ensure a clean slate after device reset.\n\n[  549.186435] [     C16] ------------[ cut here ]------------\n[  549.186457] [     C16] kernel BUG at net/core/skbuff.c:2814!\n[  549.186468] [     C16] Oops: invalid opcode: 0000 [#1] SMP NOPTI\n[  549.186472] [     C16] CPU: 16 UID: 0 PID: 0 Comm: swapper/16 Kdump: loaded Not tainted 6.16.0-rc4+ #23 PREEMPT(voluntary)\n[  549.186476] [     C16] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024\n[  549.186478] [     C16] RIP: 0010:__pskb_pull_tail+0x3ff/0x510\n[  549.186484] [     C16] Code: 06 f0 ff 4f 34 74 7b 4d 8b 8c 24 c8 00 00 00 45 8b 84 24 c0 00 00 00 e9 c8 fd ff ff 48 c7 44 24 08 00 00 00 00 e9 5e fe ff ff <0f> 0b 31 c0 e9 23 90 5b ff 41 f7 c6 ff 0f 00 00 75 bf 49 8b 06 a8\n[  549.186487] [     C16] RSP: 0018:ffffb391c0640d70 EFLAGS: 00010282\n[  549.186490] [     C16] RAX: 00000000fffffff2 RBX: ffff8fe7e4d40200 RCX: 00000000fffffff2\n[  549.186492] [     C16] RDX: ffff8fe7c3a4bf8e RSI: 0000000000000180 RDI: ffff8fe7c3a4bf40\n[  549.186494] [     C16] RBP: ffffb391c0640da8 R08: ffff8fe7c3a4c0c0 R09: 000000000000000e\n[  549.186496] [     C16] R10: ffffb391c0640d88 R11: 000000000000000e R12: ffff8fe7e4d40200\n[  549.186497] [     C16] R13: 00000000fffffff2 R14: ffff8fe7fa01a000 R15: 00000000fffffff2\n[  549.186499] [     C16] FS:  0000000000000000(0000) GS:ffff8fef5ae40000(0000) knlGS:0000000000000000\n[  549.186502] [     C16] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  549.186503] [     C16] CR2: 00007f77d81d6000 CR3: 000000051a032000 CR4: 0000000000750ef0\n[  549.186505] [     C16] PKRU: 55555554\n[  549.186507] [     C16] Call Trace:\n[  549.186510] [     C16]  <IRQ>\n[  549.186513] [     C16]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  549.186517] [     C16]  __skb_pad+0xc7/0xf0\n[  549.186523] [     C16]  wx_clean_rx_irq+0x355/0x3b0 [libwx]\n[  549.186533] [     C16]  wx_poll+0x92/0x120 [libwx]\n[  549.186540] [     C16]  __napi_poll+0x28/0x190\n[  549.186544] [     C16]  net_rx_action+0x301/0x3f0\n[  549.186548] [     C16]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  549.186551] [     C16]  ? __raw_spin_lock_irqsave+0x1e/0x50\n[  549.186554] [     C16]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  549.186557] [     C16]  ? wake_up_nohz_cpu+0x35/0x160\n[  549.186559] [     C16]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  549.186563] [     C16]  handle_softirqs+0xf9/0x2c0\n[  549.186568] [     C16]  __irq_exit_rcu+0xc7/0x130\n[  549.186572] [     C16]  common_interrupt+0xb8/0xd0\n[  549.186576] [     C16]  </IRQ>\n[  549.186577] [     C16]  <TASK>\n[  549.186579] [     C16]  asm_common_interrupt+0x22/0x40\n[  549.186582] [     C16] RIP: 0010:cpuidle_enter_state+0xc2/0x420\n[  549.186585] [     C16] Code: 00 00 e8 11 0e 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 0d ed 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d\n[  549.186587] [     C16] RSP: 0018:ffffb391c0277e78 EFLAGS: 00000246\n[  549.186590] [     C16] RAX: ffff8fef5ae40000 RBX: 0000000000000003 RCX: 0000000000000000\n[  549.186591] [     C16] RDX: 0000007fde0faac5 RSI: ffffffff826e53f6 RDI: ffffffff826fa9b3\n[  549.186593] [     C16] RBP: ffff8fe7c3a20800 R08: 0000000000000002 R09: 0000000000000000\n[  549.186595] [     C16] R10: 0000000000000000 R11: 000000000000ffff R12: ffffffff82ed7a40\n[  549.186596] [     C16] R13: 0000007fde0faac5 R14: 0000000000000003 R15: 0000000000000000\n[  549.186601] [     C16]  ? cpuidle_enter_state+0xb3/0x420\n[  549.186605] [     C16]  cpuidle_en\n---truncated---"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is armed by a local device reset triggered through ethtool (`ethtool -K rxvlan`, `-C rx-usecs`, `-L`) reaching `wx_set_features()`/`wx_set_rx_itr()` → `txgbe_do_reset()`; no remote peer can induce a ring reinitialization since the driver has no `ndo_tx_timeout` or other packet-driven reset path.\nAC:L - The condition is fully deterministic: after every reset, descriptor 0 always retains its stale `DD|EOP` writeback because `wx_alloc_rx_buffers()` clears `status_error` only after incrementing past it and the ring is never zeroed, so the first NAPI poll after the reset processes the bogus descriptor with no race, timing window, or memory-layout dependency.\nPR:L - The triggering ethtool set-operations are gated by `ns_capable(net->user_ns, CAP_NET_ADMIN)` and `GENL_UNS_ADMIN_PERM`, i.e. namespaced capabilities, so an unprivileged user who is root in a user namespace owning the netns that holds the interface (a routine SR-IOV/delegated-NIC container setup) can perform the feature toggle.\nUI:N - The attacker performs the feature toggle themselves and the corrupted descriptor is consumed automatically by the NAPI poll on the next received frame; no separate victim has to mount, open, or launch anything.\nS:U - The wild-pointer read, the malformed skb, and the resulting BUG() all occur within the kernel that owns the driver and the network stack; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `wx_pull_tail()` runs on an skb with `nr_frags == 0`, dereferencing an uninitialized `skb_shinfo()->frags[0]` and copying up to 256 bytes from an arbitrary kernel address into the skb's linear data, which is then handed to `napi_gro_receive()` for delivery to local sockets or forwarding onto the wire; the resulting `skb_headlen()` (74) also exceeds the real 60 bytes of data, giving further out-of-bounds reads.\nI:H - `skb->data_len -= pull_len` underflows to 0xfffffff2 and `skb_frag_size_sub()` writes through the garbage frag descriptor, so an skb whose `len`/`data_len`/`headlen` are mutually inconsistent is injected into the network stack, where the resulting size arithmetic drives out-of-bounds copies — kernel memory corruption at addresses the driver does not own.\nA:H - The commit message documents the concrete outcome: `kernel BUG at net/core/skbuff.c:2814` in `__pskb_pull_tail()` from `__skb_pad()` in `wx_clean_rx_irq()`, an unrecoverable panic in softirq context, and the wild frag pointer can independently fault on an unmapped address."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/wangxun/libwx/wx_hw.c","drivers/net/ethernet/wangxun/libwx/wx_lib.c"],"versions":[{"version":"3c47e8ae113a68da47987750d9896e325d0aeedd","lessThan":"d510116c80b37efb100ce8d5ee326214b0157293","status":"affected","versionType":"git"},{"version":"3c47e8ae113a68da47987750d9896e325d0aeedd","lessThan":"10e27b2a6ebeda49e9c2897a699d3ce1ded565ee","status":"affected","versionType":"git"},{"version":"3c47e8ae113a68da47987750d9896e325d0aeedd","lessThan":"ee527d3fba4dae1d619d2d0438624002c8e99e24","status":"affected","versionType":"git"},{"version":"3c47e8ae113a68da47987750d9896e325d0aeedd","lessThan":"d992ed7e1b687ad7df0763d3e015a5358646210b","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/wangxun/libwx/wx_hw.c","drivers/net/ethernet/wangxun/libwx/wx_lib.c"],"versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","status":"unaffected","versionType":"semver"},{"version":"6.6.100","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.40","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.15.8","lessThanOrEqual":"6.15.*","status":"unaffected","versionType":"semver"},{"version":"6.16","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.6.100"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.12.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.15.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.16"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/d510116c80b37efb100ce8d5ee326214b0157293"},{"url":"https://git.kernel.org/stable/c/10e27b2a6ebeda49e9c2897a699d3ce1ded565ee"},{"url":"https://git.kernel.org/stable/c/ee527d3fba4dae1d619d2d0438624002c8e99e24"},{"url":"https://git.kernel.org/stable/c/d992ed7e1b687ad7df0763d3e015a5358646210b"}],"title":"net: libwx: properly reset Rx ring descriptor","x_generator":{"engine":"bippy-1.2.0"}}}}