GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38311 (GCVE-0-2025-38311)

Vulnerability from cvelistv5 – Published: 2025-07-10 07:42 – Updated: 2026-05-23 15:59
VLAI
Title
iavf: get rid of the crit lock
Summary
In the Linux kernel, the following vulnerability has been resolved: iavf: get rid of the crit lock Get rid of the crit lock. That frees us from the error prone logic of try_locks. Thanks to netdev_lock() by Jakub it is now easy, and in most cases we were protected by it already - replace crit lock by netdev lock when it was not the case. Lockdep reports that we should cancel the work under crit_lock [splat1], and that was the scheme we have mostly followed since [1] by Slawomir. But when that is done we still got into deadlocks [splat2]. So instead we should look at the bigger problem, namely "weird locking/scheduling" of the iavf. The first step to fix that is to remove the crit lock. I will followup with a -next series that simplifies scheduling/tasks. Cancel the work without netdev lock (weird unlock+lock scheme), to fix the [splat2] (which would be totally ugly if we would kept the crit lock). Extend protected part of iavf_watchdog_task() to include scheduling more work. Note that the removed comment in iavf_reset_task() was misplaced, it belonged to inside of the removed if condition, so it's gone now. [splat1] - w/o this patch - The deadlock during VF removal: WARNING: possible circular locking dependency detected sh/3825 is trying to acquire lock: ((work_completion)(&(&adapter->watchdog_task)->work)){+.+.}-{0:0}, at: start_flush_work+0x1a1/0x470 but task is already holding lock: (&adapter->crit_lock){+.+.}-{4:4}, at: iavf_remove+0xd1/0x690 [iavf] which lock already depends on the new lock. [splat2] - when cancelling work under crit lock, w/o this series, see [2] for the band aid attempt WARNING: possible circular locking dependency detected sh/3550 is trying to acquire lock: ((wq_completion)iavf){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90 but task is already holding lock: (&dev->lock){+.+.}-{4:4}, at: iavf_remove+0xa6/0x6e0 [iavf] which lock already depends on the new lock. [1] fc2e6b3b132a ("iavf: Rework mutexes for better synchronisation") [2] https://github.com/pkitszel/linux/commit/52dddbfc2bb60294083f5711a158a
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d1639a17319ba78a018280cd2df6577a7e5d9fab , < 620ab4d6215de0b25227f9fff1a8c7fb66837cb8 (git)
Affected: d1639a17319ba78a018280cd2df6577a7e5d9fab , < 120f28a6f314fef7f282c99f196923fe44081cad (git)
Affected: 2647ff59c52ef42c853c905817ed1a7f092d59a5 (git)
Affected: 63d14a43128540016ebd4f7fa3ad3a2f0d6e642c (git)
Affected: 6.1.42 , < 6.2 (semver)
Affected: 6.4.7 , < 6.5 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.15.3 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/iavf/iavf.h",
            "drivers/net/ethernet/intel/iavf/iavf_ethtool.c",
            "drivers/net/ethernet/intel/iavf/iavf_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "620ab4d6215de0b25227f9fff1a8c7fb66837cb8",
              "status": "affected",
              "version": "d1639a17319ba78a018280cd2df6577a7e5d9fab",
              "versionType": "git"
            },
            {
              "lessThan": "120f28a6f314fef7f282c99f196923fe44081cad",
              "status": "affected",
              "version": "d1639a17319ba78a018280cd2df6577a7e5d9fab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2647ff59c52ef42c853c905817ed1a7f092d59a5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "63d14a43128540016ebd4f7fa3ad3a2f0d6e642c",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.42",
              "versionType": "semver"
            },
            {
              "lessThan": "6.5",
              "status": "affected",
              "version": "6.4.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/iavf/iavf.h",
            "drivers/net/ethernet/intel/iavf/iavf_ethtool.c",
            "drivers/net/ethernet/intel/iavf/iavf_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.42",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: get rid of the crit lock\n\nGet rid of the crit lock.\nThat frees us from the error prone logic of try_locks.\n\nThanks to netdev_lock() by Jakub it is now easy, and in most cases we were\nprotected by it already - replace crit lock by netdev lock when it was not\nthe case.\n\nLockdep reports that we should cancel the work under crit_lock [splat1],\nand that was the scheme we have mostly followed since [1] by Slawomir.\nBut when that is done we still got into deadlocks [splat2]. So instead\nwe should look at the bigger problem, namely \"weird locking/scheduling\"\nof the iavf. The first step to fix that is to remove the crit lock.\nI will followup with a -next series that simplifies scheduling/tasks.\n\nCancel the work without netdev lock (weird unlock+lock scheme),\nto fix the [splat2] (which would be totally ugly if we would kept\nthe crit lock).\n\nExtend protected part of iavf_watchdog_task() to include scheduling\nmore work.\n\nNote that the removed comment in iavf_reset_task() was misplaced,\nit belonged to inside of the removed if condition, so it\u0027s gone now.\n\n[splat1] - w/o this patch - The deadlock during VF removal:\n     WARNING: possible circular locking dependency detected\n     sh/3825 is trying to acquire lock:\n      ((work_completion)(\u0026(\u0026adapter-\u003ewatchdog_task)-\u003ework)){+.+.}-{0:0}, at: start_flush_work+0x1a1/0x470\n          but task is already holding lock:\n      (\u0026adapter-\u003ecrit_lock){+.+.}-{4:4}, at: iavf_remove+0xd1/0x690 [iavf]\n          which lock already depends on the new lock.\n\n[splat2] - when cancelling work under crit lock, w/o this series,\n\t   see [2] for the band aid attempt\n    WARNING: possible circular locking dependency detected\n    sh/3550 is trying to acquire lock:\n    ((wq_completion)iavf){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90\n        but task is already holding lock:\n    (\u0026dev-\u003elock){+.+.}-{4:4}, at: iavf_remove+0xa6/0x6e0 [iavf]\n        which lock already depends on the new lock.\n\n[1] fc2e6b3b132a (\"iavf: Rework mutexes for better synchronisation\")\n[2] https://github.com/pkitszel/linux/commit/52dddbfc2bb60294083f5711a158a"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:59:26.621Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/620ab4d6215de0b25227f9fff1a8c7fb66837cb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/120f28a6f314fef7f282c99f196923fe44081cad"
        }
      ],
      "title": "iavf: get rid of the crit lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38311",
    "datePublished": "2025-07-10T07:42:20.006Z",
    "dateReserved": "2025-04-16T04:51:24.003Z",
    "dateUpdated": "2026-05-23T15:59:26.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38311",
      "date": "2026-09-16",
      "epss": "0.00096",
      "percentile": "0.00808"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T02:02:47.000Z",
      "cve": "CVE-2025-38311",
      "id": "msrc_CVE-2025-38311",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:under_investigation": "16",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "iavf: get rid of the crit lock",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38311.json",
      "version": "13"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38311\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-10T08:15:30.010\",\"lastModified\":\"2026-06-17T09:16:35.873\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niavf: get rid of the crit lock\\n\\nGet rid of the crit lock.\\nThat frees us from the error prone logic of try_locks.\\n\\nThanks to netdev_lock() by Jakub it is now easy, and in most cases we were\\nprotected by it already - replace crit lock by netdev lock when it was not\\nthe case.\\n\\nLockdep reports that we should cancel the work under crit_lock [splat1],\\nand that was the scheme we have mostly followed since [1] by Slawomir.\\nBut when that is done we still got into deadlocks [splat2]. So instead\\nwe should look at the bigger problem, namely \\\"weird locking/scheduling\\\"\\nof the iavf. The first step to fix that is to remove the crit lock.\\nI will followup with a -next series that simplifies scheduling/tasks.\\n\\nCancel the work without netdev lock (weird unlock+lock scheme),\\nto fix the [splat2] (which would be totally ugly if we would kept\\nthe crit lock).\\n\\nExtend protected part of iavf_watchdog_task() to include scheduling\\nmore work.\\n\\nNote that the removed comment in iavf_reset_task() was misplaced,\\nit belonged to inside of the removed if condition, so it\u0027s gone now.\\n\\n[splat1] - w/o this patch - The deadlock during VF removal:\\n     WARNING: possible circular locking dependency detected\\n     sh/3825 is trying to acquire lock:\\n      ((work_completion)(\u0026(\u0026adapter-\u003ewatchdog_task)-\u003ework)){+.+.}-{0:0}, at: start_flush_work+0x1a1/0x470\\n          but task is already holding lock:\\n      (\u0026adapter-\u003ecrit_lock){+.+.}-{4:4}, at: iavf_remove+0xd1/0x690 [iavf]\\n          which lock already depends on the new lock.\\n\\n[splat2] - when cancelling work under crit lock, w/o this series,\\n\\t   see [2] for the band aid attempt\\n    WARNING: possible circular locking dependency detected\\n    sh/3550 is trying to acquire lock:\\n    ((wq_completion)iavf){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90\\n        but task is already holding lock:\\n    (\u0026dev-\u003elock){+.+.}-{4:4}, at: iavf_remove+0xa6/0x6e0 [iavf]\\n        which lock already depends on the new lock.\\n\\n[1] fc2e6b3b132a (\\\"iavf: Rework mutexes for better synchronisation\\\")\\n[2] https://github.com/pkitszel/linux/commit/52dddbfc2bb60294083f5711a158a\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iavf: eliminar el bloqueo cr\u00edtico. Eliminar el bloqueo cr\u00edtico. Esto nos libera de la l\u00f3gica propensa a errores de try_locks. Gracias a netdev_lock() de Jakub, ahora es f\u00e1cil, y en la mayor\u00eda de los casos ya est\u00e1bamos protegidos por \u00e9l: reemplazar el bloqueo cr\u00edtico por el bloqueo netdev cuando no era el caso. Lockdep informa que debemos cancelar el trabajo bajo crit_lock [splat1], y ese fue el esquema que hemos seguido principalmente desde [1] de Slawomir. Pero una vez hecho esto, seguimos teniendo interbloqueos [splat2]. As\u00ed que, en lugar de eso, deber\u00edamos analizar el problema m\u00e1s grave, es decir, el \\\"bloqueo/programaci\u00f3n extra\u00f1o\\\" de iavf. El primer paso para solucionarlo es eliminar el bloqueo cr\u00edtico. Seguir\u00e9 con una serie de -next que simplifica la programaci\u00f3n/tareas. Cancelar el trabajo sin el bloqueo de netdev (un esquema extra\u00f1o de desbloqueo y bloqueo) para corregir el [splat2] (que ser\u00eda un desastre si hubi\u00e9ramos mantenido el bloqueo cr\u00edtico). Extender la parte protegida de iavf_watchdog_task() para incluir la programaci\u00f3n de m\u00e1s trabajo. Tenga en cuenta que el comentario eliminado en iavf_reset_task() estaba mal ubicado; pertenec\u00eda a la condici\u00f3n if eliminada, por lo que ya no est\u00e1. [splat1] - sin este parche - El bloqueo durante la eliminaci\u00f3n de VF: ADVERTENCIA: se detect\u00f3 una posible dependencia de bloqueo circular sh/3825 est\u00e1 intentando adquirir el bloqueo: ((work_completion)(\u0026amp;(\u0026amp;adapter-\u0026gt;watchdog_task)-\u0026gt;work)){+.+.}-{0:0}, en: start_flush_work+0x1a1/0x470 pero la tarea ya tiene el bloqueo: (\u0026amp;adapter-\u0026gt;crit_lock){+.+.}-{4:4}, en: iavf_remove+0xd1/0x690 [iavf] cuyo bloqueo ya depende del nuevo bloqueo. [splat2] - al cancelar trabajo bajo bloqueo cr\u00edtico, sin esta serie, vea [2] para el intento de curita ADVERTENCIA: posible dependencia de bloqueo circular detectada sh/3550 est\u00e1 intentando adquirir el bloqueo: ((wq_completion)iavf){+.+.}-{0:0}, en: touch_wq_lockdep_map+0x26/0x90 pero la tarea ya tiene el bloqueo: (\u0026amp;dev-\u0026gt;lock){+.+.}-{4:4}, en: iavf_remove+0xa6/0x6e0 [iavf] cuyo bloqueo ya depende del nuevo bloqueo. [1] fc2e6b3b132a (\\\"iavf: Rehacer mutexes para mejor sincronizaci\u00f3n\\\") [2] https://github.com/pkitszel/linux/commit/52dddbfc2bb60294083f5711a158a\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/intel/iavf/iavf.h\",\"drivers/net/ethernet/intel/iavf/iavf_ethtool.c\",\"drivers/net/ethernet/intel/iavf/iavf_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d1639a17319ba78a018280cd2df6577a7e5d9fab\",\"lessThan\":\"620ab4d6215de0b25227f9fff1a8c7fb66837cb8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d1639a17319ba78a018280cd2df6577a7e5d9fab\",\"lessThan\":\"120f28a6f314fef7f282c99f196923fe44081cad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2647ff59c52ef42c853c905817ed1a7f092d59a5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"63d14a43128540016ebd4f7fa3ad3a2f0d6e642c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.42\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.4.7\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/intel/iavf/iavf.h\",\"drivers/net/ethernet/intel/iavf/iavf_ethtool.c\",\"drivers/net/ethernet/intel/iavf/iavf_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.3\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.42\",\"versionEndExcluding\":\"6.2\",\"matchCriteriaId\":\"971D00D2-7CB0-4C26-9029-03BA26299753\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4.7\",\"versionEndExcluding\":\"6.5\",\"matchCriteriaId\":\"78D465F1-2AAE-44B0-94DE-389ED298943D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5.1\",\"versionEndExcluding\":\"6.15.3\",\"matchCriteriaId\":\"089319DD-5078-403F-A561-D89120E079F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2D9420A-9BF4-4C16-B6DA-8A1D279F7384\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5608371-157A-4318-8A2E-4104C3467EA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"2226A776-DF8C-49E0-A030-0A7853BB018A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F15C659-DF06-455A-9765-0E6DE920F29A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"5B1C14ED-ABC4-41D3-8D9C-D38C6A65B4DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F187F8CD-249A-4AF1-877B-08E8C24A1A10\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/120f28a6f314fef7f282c99f196923fe44081cad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/620ab4d6215de0b25227f9fff1a8c7fb66837cb8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T01:03:27+00:00",
      "cve": "CVE-2025-38311",
      "id": "CVE-2025-38311",
      "initial_release_date": "2025-07-10T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel (iavf): Denial of Service due to a locking issue",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38311.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T17:01:51Z",
      "cve": "CVE-2025-38311",
      "id": "CVE-2025-38311",
      "initial_release_date": "2025-07-11T23:22:29Z",
      "product_status:first_fixed": "2",
      "product_status:known_not_affected": "557",
      "product_status:recommended": "154",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38311",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38311.json",
      "version": "29"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.