CVE-2025-38375 (GCVE-0-2025-38375)

Vulnerability from cvelistv5 – Published: 2025-07-25 12:53 – Updated: 2026-08-05 12:01
VLAI
Title
virtio-net: ensure the received length does not exceed allocated size
Summary
In the Linux kernel, the following vulnerability has been resolved: virtio-net: ensure the received length does not exceed allocated size In xdp_linearize_page, when reading the following buffers from the ring, we forget to check the received length with the true allocate size. This can lead to an out-of-bound read. This commit adds that missing check.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4941d472bf95b4345d6e38906fcf354e74afa311 , < 773e95c268b5d859f51f7547559734fd2a57660c (git)
Affected: 4941d472bf95b4345d6e38906fcf354e74afa311 , < ddc8649d363141fb3371dd81a73e1cb4ef8ed1e1 (git)
Affected: 4941d472bf95b4345d6e38906fcf354e74afa311 , < 982beb7582c193544eb9c6083937ec5ac1c9d651 (git)
Affected: 4941d472bf95b4345d6e38906fcf354e74afa311 , < 6aca3dad2145e864dfe4d1060f45eb1bac75dd58 (git)
Affected: 4941d472bf95b4345d6e38906fcf354e74afa311 , < 80b971be4c37a4d23a7f1abc5ff33dc7733d649b (git)
Affected: 4941d472bf95b4345d6e38906fcf354e74afa311 , < bc68bc3563344ccdc57d1961457cdeecab8f81ef (git)
Affected: 4941d472bf95b4345d6e38906fcf354e74afa311 , < 11f2d0e8be2b5e784ac45fa3da226492c3e506d8 (git)
Affected: 4941d472bf95b4345d6e38906fcf354e74afa311 , < 315dbdd7cdf6aa533829774caaf4d25f1fd20e73 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.14
Unaffected: 0 , < 4.14 (semver)
Unaffected: 5.4.297 , ≤ 5.4.* (semver)
Unaffected: 5.10.241 , ≤ 5.10.* (semver)
Unaffected: 5.15.189 , ≤ 5.15.* (semver)
Unaffected: 6.1.144 , ≤ 6.1.* (semver)
Unaffected: 6.6.97 , ≤ 6.6.* (semver)
Unaffected: 6.12.37 , ≤ 6.12.* (semver)
Unaffected: 6.15.6 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:12.435Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "773e95c268b5d859f51f7547559734fd2a57660c",
              "status": "affected",
              "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
              "versionType": "git"
            },
            {
              "lessThan": "ddc8649d363141fb3371dd81a73e1cb4ef8ed1e1",
              "status": "affected",
              "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
              "versionType": "git"
            },
            {
              "lessThan": "982beb7582c193544eb9c6083937ec5ac1c9d651",
              "status": "affected",
              "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
              "versionType": "git"
            },
            {
              "lessThan": "6aca3dad2145e864dfe4d1060f45eb1bac75dd58",
              "status": "affected",
              "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
              "versionType": "git"
            },
            {
              "lessThan": "80b971be4c37a4d23a7f1abc5ff33dc7733d649b",
              "status": "affected",
              "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
              "versionType": "git"
            },
            {
              "lessThan": "bc68bc3563344ccdc57d1961457cdeecab8f81ef",
              "status": "affected",
              "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
              "versionType": "git"
            },
            {
              "lessThan": "11f2d0e8be2b5e784ac45fa3da226492c3e506d8",
              "status": "affected",
              "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
              "versionType": "git"
            },
            {
              "lessThan": "315dbdd7cdf6aa533829774caaf4d25f1fd20e73",
              "status": "affected",
              "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.189",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.144",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: ensure the received length does not exceed allocated size\n\nIn xdp_linearize_page, when reading the following buffers from the ring,\nwe forget to check the received length with the true allocate size. This\ncan lead to an out-of-bound read. This commit adds that missing check."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker-controlled value is the used-ring length written by the virtio backend (hypervisor/VMM, vhost-user daemon, VDUSE device, or vDPA hardware), not anything carried in received network packets, so a remote peer cannot reach it. The attack is delivered over the local paravirtual transport, matching kernel CNA precedent for virtio device-supplied-length bugs (CVE-2026-64456, CVE-2026-46123).\nAC:L - The backend fully and deterministically controls both `hdr-\u003enum_buffers` and the used-ring `len`, with no race to win and no memory-layout guessing required; a single crafted RX completion triggers it every time. XDP attachment is a target configuration the backend can observe via the guest\u0027s headroom/GSO renegotiation, not an uncontrollable condition.\nPR:N - The malicious backend needs no credentials, account, or capability inside the victim guest \u2014 it simply completes a receive buffer with a bogus length. This matches the PR:N scoring used for the equivalent virtio_bt and hwrng-virtio device-length CVEs.\nUI:N - Triggering requires only that the driver process an RX completion in NAPI/softirq context, which happens automatically. No victim action of any kind is needed.\nS:U - The vulnerable component and the impacted component are both the virtio_net driver\u0027s own kernel, and a host-to-guest attack does not gain the attacker authority it did not already hold. This is not a guest-to-host escape or an IOMMU/DMA boundary bypass.\nC:H - Each malformed completion copies up to ~3.5 KB of adjacent kernel memory into the linearized packet, which the XDP program can then XDP_TX/XDP_REDIRECT back to the attacker or which reaches userspace via a socket, giving a repeatable kernel memory disclosure channel. The integer-overflow variant extends the read arbitrarily far past the source buffer.\nI:H - The `page_off + buflen + tailroom \u003e PAGE_SIZE` guard is defeated by unsigned wraparound (verified: `buflen = 0xFFFFFD5C` makes the sum evaluate to 0), so the memcpy writes gigabytes beyond the single-page destination, corrupting arbitrary kernel heap memory. That is an out-of-bounds write, not merely the out-of-bounds read named in the commit message.\nA:H - Reading past the end of the source page, or the multi-gigabyte memcpy from the overflow variant, faults in softirq context and oopses/panics the kernel, and is instantly reproducible under KASAN or DEBUG_PAGEALLOC. The wholesale kernel memory corruption makes a crash the expected outcome."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:26.660Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/773e95c268b5d859f51f7547559734fd2a57660c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddc8649d363141fb3371dd81a73e1cb4ef8ed1e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/982beb7582c193544eb9c6083937ec5ac1c9d651"
        },
        {
          "url": "https://git.kernel.org/stable/c/6aca3dad2145e864dfe4d1060f45eb1bac75dd58"
        },
        {
          "url": "https://git.kernel.org/stable/c/80b971be4c37a4d23a7f1abc5ff33dc7733d649b"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc68bc3563344ccdc57d1961457cdeecab8f81ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/11f2d0e8be2b5e784ac45fa3da226492c3e506d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/315dbdd7cdf6aa533829774caaf4d25f1fd20e73"
        }
      ],
      "title": "virtio-net: ensure the received length does not exceed allocated size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38375",
    "datePublished": "2025-07-25T12:53:17.629Z",
    "dateReserved": "2025-04-16T04:51:24.009Z",
    "dateUpdated": "2026-08-05T12:01:26.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38375",
      "date": "2026-09-28",
      "epss": "0.00184",
      "percentile": "0.07146"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-24T14:36:58.000Z",
      "cve": "CVE-2025-38375",
      "id": "msrc_CVE-2025-38375",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "virtio-net: ensure the received length does not exceed allocated size",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38375.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/virtio_net.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "773e95c268b5d859f51f7547559734fd2a57660c",
                    "status": "affected",
                    "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ddc8649d363141fb3371dd81a73e1cb4ef8ed1e1",
                    "status": "affected",
                    "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "982beb7582c193544eb9c6083937ec5ac1c9d651",
                    "status": "affected",
                    "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6aca3dad2145e864dfe4d1060f45eb1bac75dd58",
                    "status": "affected",
                    "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "80b971be4c37a4d23a7f1abc5ff33dc7733d649b",
                    "status": "affected",
                    "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bc68bc3563344ccdc57d1961457cdeecab8f81ef",
                    "status": "affected",
                    "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "11f2d0e8be2b5e784ac45fa3da226492c3e506d8",
                    "status": "affected",
                    "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "315dbdd7cdf6aa533829774caaf4d25f1fd20e73",
                    "status": "affected",
                    "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/virtio_net.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.14"
                  },
                  {
                    "lessThan": "4.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.297",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.241",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.189",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.144",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.37",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.15.*",
                    "status": "unaffected",
                    "version": "6.15.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.16",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B29C5E30-71B7-40E0-9EA4-4A316145D06D",
                    "versionEndExcluding": "5.4.297",
                    "versionStartIncluding": "4.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D0D21C35-EB8A-488A-BBF9-403E4817E5DD",
                    "versionEndExcluding": "5.10.241",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3CE0FB9A-DBE8-48B6-BF6E-3C724A4991E3",
                    "versionEndExcluding": "5.15.189",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "81CF08DB-B7A2-4556-8AE3-ED9144F50E31",
                    "versionEndExcluding": "6.1.144",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EB1BB991-B903-4718-966C-07C803CBEABC",
                    "versionEndExcluding": "6.6.97",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6B4159AA-C70D-4DE5-9EE2-8F2728F13C5D",
                    "versionEndExcluding": "6.12.37",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6E0BB4E0-44BC-4645-83A8-6EA232CE624C",
                    "versionEndExcluding": "6.15.6",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: ensure the received length does not exceed allocated size\n\nIn xdp_linearize_page, when reading the following buffers from the ring,\nwe forget to check the received length with the true allocate size. This\ncan lead to an out-of-bound read. This commit adds that missing check."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: virtio-net: garantizar que la longitud recibida no supere el tama\u00f1o asignado. En xdp_linearize_page, al leer los siguientes b\u00faferes del anillo, se olvida verificar la longitud recibida con el tama\u00f1o asignado real. Esto puede provocar una lectura fuera de los l\u00edmites. Este commit a\u00f1ade esta verificaci\u00f3n faltante."
          }
        ],
        "id": "CVE-2025-38375",
        "lastModified": "2026-07-30T06:23:10.880",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-07-25T13:15:26.517",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/11f2d0e8be2b5e784ac45fa3da226492c3e506d8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/315dbdd7cdf6aa533829774caaf4d25f1fd20e73"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6aca3dad2145e864dfe4d1060f45eb1bac75dd58"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/773e95c268b5d859f51f7547559734fd2a57660c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/80b971be4c37a4d23a7f1abc5ff33dc7733d649b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/982beb7582c193544eb9c6083937ec5ac1c9d651"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bc68bc3563344ccdc57d1961457cdeecab8f81ef"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ddc8649d363141fb3371dd81a73e1cb4ef8ed1e1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T11:22:12+00:00",
      "cve": "CVE-2025-38375",
      "id": "CVE-2025-38375",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:known_affected": "170",
      "product_status:known_not_affected": "104",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: virtio-net: ensure the received length does not exceed allocated size",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38375.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-19T02:08:58Z",
      "cve": "CVE-2025-38375",
      "id": "CVE-2025-38375",
      "initial_release_date": "2025-07-29T23:24:09Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "543",
      "product_status:known_not_affected": "64",
      "product_status:recommended": "746",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38375",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38375.json",
      "version": "60"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.