GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38341 (GCVE-0-2025-38341)

Vulnerability from cvelistv5 – Published: 2025-07-10 08:15 – Updated: 2026-08-05 12:01
VLAI
Title
eth: fbnic: avoid double free when failing to DMA-map FW msg
Summary
In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: avoid double free when failing to DMA-map FW msg The semantics are that caller of fbnic_mbx_map_msg() retains the ownership of the message on error. All existing callers dutifully free the page.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: da3cde08209ec1c915195c2331c275397f34a731 , < 670179265ad787b9dd8e701601914618b8927755 (git)
Affected: da3cde08209ec1c915195c2331c275397f34a731 , < 0a211e23852019ef55c70094524e87a944accbb5 (git)
Affected: da3cde08209ec1c915195c2331c275397f34a731 , < 5bd1bafd4474ee26f504b41aba11f3e2a1175b88 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.35 , ≤ 6.12.* (semver)
Unaffected: 6.15.4 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/meta/fbnic/fbnic_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "670179265ad787b9dd8e701601914618b8927755",
              "status": "affected",
              "version": "da3cde08209ec1c915195c2331c275397f34a731",
              "versionType": "git"
            },
            {
              "lessThan": "0a211e23852019ef55c70094524e87a944accbb5",
              "status": "affected",
              "version": "da3cde08209ec1c915195c2331c275397f34a731",
              "versionType": "git"
            },
            {
              "lessThan": "5bd1bafd4474ee26f504b41aba11f3e2a1175b88",
              "status": "affected",
              "version": "da3cde08209ec1c915195c2331c275397f34a731",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/meta/fbnic/fbnic_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: avoid double free when failing to DMA-map FW msg\n\nThe semantics are that caller of fbnic_mbx_map_msg() retains\nthe ownership of the message on error. All existing callers\ndutifully free the page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - All trigger paths are local \u2014 a world-readable hwmon sysfs read (`/sys/class/hwmon/hwmonN/temp1_input`, mode 0444), netdev open/close ownership messages, devlink flash, and the driver\u0027s own heartbeat/mailbox-refill timers. No remote peer data reaches this code path.\nAC:L - The vulnerable path can be invoked at will and repeatedly (each sensor read issues up to five mailbox messages), and the required `dma_map_single()` failure is reachable by driving IOVA/swiotlb pressure concurrently, so the attacker can influence both the trigger rate and the failure condition.\nPR:L - `fbnic_hwmon_is_visible()` exposes the sensor attributes as 0444, so any unprivileged local account can drive `fbnic_fw_xmit_tsene_read_msg()` into `fbnic_mbx_map_msg()`; the heartbeat and Rx-refill callers reach the same code with no user context at all.\nUI:N - No victim action is needed \u2014 the attacker reads a sysfs file directly, and the heartbeat/mailbox-refill paths execute autonomously.\nS:U - The double free corrupts the kernel\u0027s own page allocator state within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The `spin_unlock_irqrestore()` between the two `free_page()` calls opens a window for the page to be reallocated, so the second free hands an in-use page back to the allocator, allowing the attacker to obtain a page aliased with another allocation and read its contents.\nI:H - The same cross-allocation aliasing yields a write primitive over memory belonging to another owner (kernel structures or another task\u0027s pages), which is exploitable for control-flow hijacking or privilege escalation.\nA:H - With `CONFIG_DEBUG_VM` the second free hits `VM_BUG_ON_PAGE(page_ref_count(page) == 0)` for an immediate BUG/oops; otherwise the `_refcount` underflow and resulting use-after-free readily panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:13.843Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/670179265ad787b9dd8e701601914618b8927755"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a211e23852019ef55c70094524e87a944accbb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bd1bafd4474ee26f504b41aba11f3e2a1175b88"
        }
      ],
      "title": "eth: fbnic: avoid double free when failing to DMA-map FW msg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38341",
    "datePublished": "2025-07-10T08:15:10.928Z",
    "dateReserved": "2025-04-16T04:51:24.005Z",
    "dateUpdated": "2026-08-05T12:01:13.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38341",
      "date": "2026-09-19",
      "epss": "0.00161",
      "percentile": "0.05699"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/meta/fbnic/fbnic_fw.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "670179265ad787b9dd8e701601914618b8927755",
                    "status": "affected",
                    "version": "da3cde08209ec1c915195c2331c275397f34a731",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0a211e23852019ef55c70094524e87a944accbb5",
                    "status": "affected",
                    "version": "da3cde08209ec1c915195c2331c275397f34a731",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5bd1bafd4474ee26f504b41aba11f3e2a1175b88",
                    "status": "affected",
                    "version": "da3cde08209ec1c915195c2331c275397f34a731",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/meta/fbnic/fbnic_fw.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.11"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.15.*",
                    "status": "unaffected",
                    "version": "6.15.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.16",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "50E16863-852A-4232-B230-626F86B126F4",
                    "versionEndExcluding": "6.12.35",
                    "versionStartIncluding": "6.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DFD174C5-1AA2-4671-BDDC-1A9FCC753655",
                    "versionEndExcluding": "6.15.4",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: avoid double free when failing to DMA-map FW msg\n\nThe semantics are that caller of fbnic_mbx_map_msg() retains\nthe ownership of the message on error. All existing callers\ndutifully free the page."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: eth: fbnic: evita la doble liberaci\u00f3n al no poder asignar DMA a FW msg. La sem\u00e1ntica es que quien llama a fbnic_mbx_map_msg() conserva la propiedad del mensaje en caso de error. Todos los que llaman liberan la p\u00e1gina correctamente."
          }
        ],
        "id": "CVE-2025-38341",
        "lastModified": "2026-07-30T06:23:07.843",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-07-10T09:15:28.890",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0a211e23852019ef55c70094524e87a944accbb5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5bd1bafd4474ee26f504b41aba11f3e2a1175b88"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/670179265ad787b9dd8e701601914618b8927755"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-415"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:29:38+00:00",
      "cve": "CVE-2025-38341",
      "id": "CVE-2025-38341",
      "initial_release_date": "2025-07-10T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: eth: fbnic: avoid double free when failing to DMA-map FW msg",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38341.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:01:15Z",
      "cve": "CVE-2025-38341",
      "id": "CVE-2025-38341",
      "initial_release_date": "2025-07-10T23:22:12Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "5",
      "product_status:known_not_affected": "555",
      "product_status:recommended": "154",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38341",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38341.json",
      "version": "33"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.