CVE-2025-38146 (GCVE-0-2025-38146)

Vulnerability from cvelistv5 – Published: 2025-07-03 08:35 – Updated: 2026-08-05 11:59
VLAI
Title
net: openvswitch: Fix the dead loop of MPLS parse
Summary
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix the dead loop of MPLS parse The unexpected MPLS packet may not end with the bottom label stack. When there are many stacks, The label count value has wrapped around. A dead loop occurs, soft lockup/CPU stuck finally. stack backtrace: UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26 index -1 is out of range for type '__be32 [3]' CPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G OE 5.15.0-121-generic #131-Ubuntu Hardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021 Call Trace: <IRQ> show_stack+0x52/0x5c dump_stack_lvl+0x4a/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x36 __ubsan_handle_out_of_bounds.cold+0x44/0x49 key_extract_l3l4+0x82a/0x840 [openvswitch] ? kfree_skbmem+0x52/0xa0 key_extract+0x9c/0x2b0 [openvswitch] ovs_flow_key_extract+0x124/0x350 [openvswitch] ovs_vport_receive+0x61/0xd0 [openvswitch] ? kernel_init_free_pages.part.0+0x4a/0x70 ? get_page_from_freelist+0x353/0x540 netdev_port_receive+0xc4/0x180 [openvswitch] ? netdev_port_receive+0x180/0x180 [openvswitch] netdev_frame_hook+0x1f/0x40 [openvswitch] __netif_receive_skb_core.constprop.0+0x23a/0xf00 __netif_receive_skb_list_core+0xfa/0x240 netif_receive_skb_list_internal+0x18e/0x2a0 napi_complete_done+0x7a/0x1c0 bnxt_poll+0x155/0x1c0 [bnxt_en] __napi_poll+0x30/0x180 net_rx_action+0x126/0x280 ? bnxt_msix+0x67/0x80 [bnxt_en] handle_softirqs+0xda/0x2d0 irq_exit_rcu+0x96/0xc0 common_interrupt+0x8e/0xa0 </IRQ>
Severity
9.4 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 , < 4b9a086eedc1fddae632310386098c12155e3d0a (git)
Affected: fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 , < ad17eb86d042d72a59fd184ad1adf34f5eb36843 (git)
Affected: fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 , < f26fe7c3002516dd3c288f1012786df31f4d89e0 (git)
Affected: fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 , < 8ebcd311b4866ab911d1445ead08690e67f0c488 (git)
Affected: fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 , < 69541e58323ec3e3904e1fa87a6213961b1f52f4 (git)
Affected: fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 , < 3c1906a3d50cb94fd0a10e97a1c0a40c0f033cb7 (git)
Affected: fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 , < 0bdc924bfb319fb10d1113cbf091fc26fb7b1f99 (git)
Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 5.10.239 , ≤ 5.10.* (semver)
Unaffected: 5.15.186 , ≤ 5.15.* (semver)
Unaffected: 6.1.142 , ≤ 6.1.* (semver)
Unaffected: 6.6.94 , ≤ 6.6.* (semver)
Unaffected: 6.12.34 , ≤ 6.12.* (semver)
Unaffected: 6.15.3 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:34:37.672Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/flow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4b9a086eedc1fddae632310386098c12155e3d0a",
              "status": "affected",
              "version": "fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3",
              "versionType": "git"
            },
            {
              "lessThan": "ad17eb86d042d72a59fd184ad1adf34f5eb36843",
              "status": "affected",
              "version": "fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3",
              "versionType": "git"
            },
            {
              "lessThan": "f26fe7c3002516dd3c288f1012786df31f4d89e0",
              "status": "affected",
              "version": "fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3",
              "versionType": "git"
            },
            {
              "lessThan": "8ebcd311b4866ab911d1445ead08690e67f0c488",
              "status": "affected",
              "version": "fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3",
              "versionType": "git"
            },
            {
              "lessThan": "69541e58323ec3e3904e1fa87a6213961b1f52f4",
              "status": "affected",
              "version": "fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3",
              "versionType": "git"
            },
            {
              "lessThan": "3c1906a3d50cb94fd0a10e97a1c0a40c0f033cb7",
              "status": "affected",
              "version": "fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3",
              "versionType": "git"
            },
            {
              "lessThan": "0bdc924bfb319fb10d1113cbf091fc26fb7b1f99",
              "status": "affected",
              "version": "fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/flow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: Fix the dead loop of MPLS parse\n\nThe unexpected MPLS packet may not end with the bottom label stack.\nWhen there are many stacks, The label count value has wrapped around.\nA dead loop occurs, soft lockup/CPU stuck finally.\n\nstack backtrace:\nUBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26\nindex -1 is out of range for type \u0027__be32 [3]\u0027\nCPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G           OE   5.15.0-121-generic #131-Ubuntu\nHardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021\nCall Trace:\n \u003cIRQ\u003e\n show_stack+0x52/0x5c\n dump_stack_lvl+0x4a/0x63\n dump_stack+0x10/0x16\n ubsan_epilogue+0x9/0x36\n __ubsan_handle_out_of_bounds.cold+0x44/0x49\n key_extract_l3l4+0x82a/0x840 [openvswitch]\n ? kfree_skbmem+0x52/0xa0\n key_extract+0x9c/0x2b0 [openvswitch]\n ovs_flow_key_extract+0x124/0x350 [openvswitch]\n ovs_vport_receive+0x61/0xd0 [openvswitch]\n ? kernel_init_free_pages.part.0+0x4a/0x70\n ? get_page_from_freelist+0x353/0x540\n netdev_port_receive+0xc4/0x180 [openvswitch]\n ? netdev_port_receive+0x180/0x180 [openvswitch]\n netdev_frame_hook+0x1f/0x40 [openvswitch]\n __netif_receive_skb_core.constprop.0+0x23a/0xf00\n __netif_receive_skb_list_core+0xfa/0x240\n netif_receive_skb_list_internal+0x18e/0x2a0\n napi_complete_done+0x7a/0x1c0\n bnxt_poll+0x155/0x1c0 [bnxt_en]\n __napi_poll+0x30/0x180\n net_rx_action+0x126/0x280\n ? bnxt_msix+0x67/0x80 [bnxt_en]\n handle_softirqs+0xda/0x2d0\n irq_exit_rcu+0x96/0xc0\n common_interrupt+0x8e/0xa0\n \u003c/IRQ\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The parse runs in the OVS receive path before any flow lookup, and OVS tunnel vports (VXLAN/Geneve/GRETAP, created with VXLAN_F_COLLECT_METADATA so any source IP and VNI is accepted) hand their decapsulated inner Ethernet frame to netdev_frame_hook, letting a routed remote attacker deliver the malicious MPLS stack. On plain netdev ports OVS also forces IFF_PROMISC, so any frame reaching the NIC is parsed regardless of destination MAC.\nAC:L - A single ~1 KB Ethernet frame with ethertype 0x8847 and 256 MPLS label-stack entries with S=0 deterministically wraps the u8 counter; there is no race, no memory-layout dependency, and no state the attacker does not control.\nPR:N - The entire path (netdev_frame_hook \u2192 ovs_vport_receive \u2192 ovs_flow_key_extract \u2192 key_extract_l3l4) is a softirq packet handler with no syscall, capability check, or authentication, and key extraction precedes flow lookup so no OVS flow rule need permit the traffic.\nUI:N - The malformed frame is parsed automatically on receipt; no action by any local user or administrator is involved.\nS:U - The lockup and memory-safety violations are confined to the kernel that parses the packet; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The same counter wrap leaves num_labels_mask = GENMASK(-1,0) = 0xffffffff, so hweight_long() yields 32 and __ovs_nla_put_key() reads lse[0..31] \u2014 128 bytes out of a 12-byte array, running ~36 bytes past the stack-resident sw_flow_key plus ~56 bytes of never-initialized union tail \u2014 and copies that kernel stack content into the netlink upcall message. This is far beyond a strictly bounded few-byte read.\nI:L - The wrap produces a 4-byte attacker-controlled out-of-bounds write at lse[-1], which lands on the adjacent in-struct num_labels_mask, leaving the flow key claiming 32 MPLS labels and able to drive incorrect flow classification/installation. It is bounded within the object and yields no arbitrary-write or control-flow-hijack primitive.\nA:H - Rewinding the inner network header on the wrap iteration creates an unbounded loop inside net_rx_action/NAPI softirq, permanently wedging that CPU with a soft lockup / CPU stuck (exactly as reported in production on a bnxt_en NIC). Repeating the packet across RX queues can wedge every CPU, requiring a reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:52.250Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4b9a086eedc1fddae632310386098c12155e3d0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad17eb86d042d72a59fd184ad1adf34f5eb36843"
        },
        {
          "url": "https://git.kernel.org/stable/c/f26fe7c3002516dd3c288f1012786df31f4d89e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ebcd311b4866ab911d1445ead08690e67f0c488"
        },
        {
          "url": "https://git.kernel.org/stable/c/69541e58323ec3e3904e1fa87a6213961b1f52f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c1906a3d50cb94fd0a10e97a1c0a40c0f033cb7"
        },
        {
          "url": "https://git.kernel.org/stable/c/0bdc924bfb319fb10d1113cbf091fc26fb7b1f99"
        }
      ],
      "title": "net: openvswitch: Fix the dead loop of MPLS parse",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38146",
    "datePublished": "2025-07-03T08:35:52.230Z",
    "dateReserved": "2025-04-16T04:51:23.988Z",
    "dateUpdated": "2026-08-05T11:59:52.250Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38146",
      "date": "2026-08-06",
      "epss": "0.00402",
      "percentile": "0.33001"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:27:57.000Z",
      "cve": "CVE-2025-38146",
      "id": "msrc_CVE-2025-38146",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: openvswitch: Fix the dead loop of MPLS parse",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38146.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38146\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-03T09:15:29.410\",\"lastModified\":\"2026-07-30T06:22:55.253\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: openvswitch: Fix the dead loop of MPLS parse\\n\\nThe unexpected MPLS packet may not end with the bottom label stack.\\nWhen there are many stacks, The label count value has wrapped around.\\nA dead loop occurs, soft lockup/CPU stuck finally.\\n\\nstack backtrace:\\nUBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26\\nindex -1 is out of range for type \u0027__be32 [3]\u0027\\nCPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G           OE   5.15.0-121-generic #131-Ubuntu\\nHardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021\\nCall Trace:\\n \u003cIRQ\u003e\\n show_stack+0x52/0x5c\\n dump_stack_lvl+0x4a/0x63\\n dump_stack+0x10/0x16\\n ubsan_epilogue+0x9/0x36\\n __ubsan_handle_out_of_bounds.cold+0x44/0x49\\n key_extract_l3l4+0x82a/0x840 [openvswitch]\\n ? kfree_skbmem+0x52/0xa0\\n key_extract+0x9c/0x2b0 [openvswitch]\\n ovs_flow_key_extract+0x124/0x350 [openvswitch]\\n ovs_vport_receive+0x61/0xd0 [openvswitch]\\n ? kernel_init_free_pages.part.0+0x4a/0x70\\n ? get_page_from_freelist+0x353/0x540\\n netdev_port_receive+0xc4/0x180 [openvswitch]\\n ? netdev_port_receive+0x180/0x180 [openvswitch]\\n netdev_frame_hook+0x1f/0x40 [openvswitch]\\n __netif_receive_skb_core.constprop.0+0x23a/0xf00\\n __netif_receive_skb_list_core+0xfa/0x240\\n netif_receive_skb_list_internal+0x18e/0x2a0\\n napi_complete_done+0x7a/0x1c0\\n bnxt_poll+0x155/0x1c0 [bnxt_en]\\n __napi_poll+0x30/0x180\\n net_rx_action+0x126/0x280\\n ? bnxt_msix+0x67/0x80 [bnxt_en]\\n handle_softirqs+0xda/0x2d0\\n irq_exit_rcu+0x96/0xc0\\n common_interrupt+0x8e/0xa0\\n \u003c/IRQ\u003e\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: openvswitch: Se corrige el bucle muerto del an\u00e1lisis MPLS. El paquete MPLS inesperado podr\u00eda no terminar en la \u00faltima pila de etiquetas. Cuando hay muchas pilas, el valor del recuento de etiquetas se reinicia. Se produce un bucle muerto y, finalmente, se bloquea la CPU. seguimiento de pila: UBSAN: \u00edndice de matriz fuera de los l\u00edmites en /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26 el \u00edndice -1 est\u00e1 fuera de rango para el tipo \u0027__be32 [3]\u0027 CPU: 34 PID: 0 Comm: swapper/34 Kdump: cargado Tainted: G OE 5.15.0-121-generic #131-Ubuntu Nombre del hardware: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 14/07/2021 Seguimiento de llamadas:  show_stack+0x52/0x5c dump_stack_lvl+0x4a/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x36 __ubsan_handle_out_of_bounds.cold+0x44/0x49 key_extract_l3l4+0x82a/0x840 [openvswitch] ? kfree_skbmem+0x52/0xa0 key_extract+0x9c/0x2b0 [openvswitch] ovs_flow_key_extract+0x124/0x350 [openvswitch] ovs_vport_receive+0x61/0xd0 [openvswitch] ? kernel_init_free_pages.part.0+0x4a/0x70 ? get_page_from_freelist+0x353/0x540 netdev_port_receive+0xc4/0x180 [openvswitch] ? netdev_port_receive+0x180/0x180 [openvswitch] netdev_frame_hook+0x1f/0x40 [openvswitch] __netif_receive_skb_core.constprop.0+0x23a/0xf00 __netif_receive_skb_list_core+0xfa/0x240 netif_receive_skb_list_internal+0x18e/0x2a0 napi_complete_done+0x7a/0x1c0 bnxt_poll+0x155/0x1c0 [bnxt_en] __napi_poll+0x30/0x180 net_rx_action+0x126/0x280 ? bnxt_msix+0x67/0x80 [bnxt_en] handle_softirqs+0xda/0x2d0 irq_exit_rcu+0x96/0xc0 common_interrupt+0x8e/0xa0  \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/openvswitch/flow.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3\",\"lessThan\":\"4b9a086eedc1fddae632310386098c12155e3d0a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3\",\"lessThan\":\"ad17eb86d042d72a59fd184ad1adf34f5eb36843\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3\",\"lessThan\":\"f26fe7c3002516dd3c288f1012786df31f4d89e0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3\",\"lessThan\":\"8ebcd311b4866ab911d1445ead08690e67f0c488\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3\",\"lessThan\":\"69541e58323ec3e3904e1fa87a6213961b1f52f4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3\",\"lessThan\":\"3c1906a3d50cb94fd0a10e97a1c0a40c0f033cb7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3\",\"lessThan\":\"0bdc924bfb319fb10d1113cbf091fc26fb7b1f99\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/openvswitch/flow.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.239\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.186\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.142\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.94\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.34\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.3\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H\",\"baseScore\":9.4,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-129\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.239\",\"matchCriteriaId\":\"C3D14F4C-A21E-465D-A928-5CCE684E2B98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.186\",\"matchCriteriaId\":\"D96F2C0D-0D4A-4658-AD34-D8A626EA422D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.142\",\"matchCriteriaId\":\"459B4E94-FE0E-434D-B782-95E3A5FFC6B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.94\",\"matchCriteriaId\":\"304E3F01-7D7A-4908-994E-7F95C5C00B06\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.34\",\"matchCriteriaId\":\"4FFA54AA-CDFE-4591-BD07-72813D0948F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.3\",\"matchCriteriaId\":\"0541C761-BD5E-4C1A-8432-83B375D7EB92\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0bdc924bfb319fb10d1113cbf091fc26fb7b1f99\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3c1906a3d50cb94fd0a10e97a1c0a40c0f033cb7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4b9a086eedc1fddae632310386098c12155e3d0a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/69541e58323ec3e3904e1fa87a6213961b1f52f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ebcd311b4866ab911d1445ead08690e67f0c488\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ad17eb86d042d72a59fd184ad1adf34f5eb36843\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f26fe7c3002516dd3c288f1012786df31f4d89e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:23:47+00:00",
      "cve": "CVE-2025-38146",
      "id": "CVE-2025-38146",
      "initial_release_date": "2025-07-03T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel Open vSwitch: Denial of Service via malformed MPLS packets",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38146.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T00:50:47Z",
      "cve": "CVE-2025-38146",
      "id": "CVE-2025-38146",
      "initial_release_date": "2025-07-04T14:38:26Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "575",
      "product_status:known_not_affected": "156",
      "product_status:recommended": "508",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38146",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38146.json",
      "version": "51"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.