GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38413 (GCVE-0-2025-38413)

Vulnerability from cvelistv5 – Published: 2025-07-25 13:20 – Updated: 2026-08-05 12:01
VLAI
Title
virtio-net: xsk: rx: fix the frame's length check
Summary
In the Linux kernel, the following vulnerability has been resolved: virtio-net: xsk: rx: fix the frame's length check When calling buf_to_xdp, the len argument is the frame data's length without virtio header's length (vi->hdr_len). We check that len with xsk_pool_get_rx_frame_size() + vi->hdr_len to ensure the provided len does not larger than the allocated chunk size. The additional vi->hdr_len is because in virtnet_add_recvbuf_xsk, we use part of XDP_PACKET_HEADROOM for virtio header and ask the vhost to start placing data from hard_start + XDP_PACKET_HEADROOM - vi->hdr_len not hard_start + XDP_PACKET_HEADROOM But the first buffer has virtio_header, so the maximum frame's length in the first buffer can only be xsk_pool_get_rx_frame_size() not xsk_pool_get_rx_frame_size() + vi->hdr_len like in the current check. This commit adds an additional argument to buf_to_xdp differentiate between the first buffer and other ones to correctly calculate the maximum frame's length.
Severity
7.7 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a4e7ba7027012f009f22a68bcfde670f9298d3a4 , < 892f6ed9a4a38bb3360fdff091b9241cfa105b61 (git)
Affected: a4e7ba7027012f009f22a68bcfde670f9298d3a4 , < 6013bb6bc24c2cac3f45b37a15b71b232a5b00ff (git)
Affected: a4e7ba7027012f009f22a68bcfde670f9298d3a4 , < 5177373c31318c3c6a190383bfd232e6cf565c36 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.37 , ≤ 6.12.* (semver)
Unaffected: 6.15.6 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "892f6ed9a4a38bb3360fdff091b9241cfa105b61",
              "status": "affected",
              "version": "a4e7ba7027012f009f22a68bcfde670f9298d3a4",
              "versionType": "git"
            },
            {
              "lessThan": "6013bb6bc24c2cac3f45b37a15b71b232a5b00ff",
              "status": "affected",
              "version": "a4e7ba7027012f009f22a68bcfde670f9298d3a4",
              "versionType": "git"
            },
            {
              "lessThan": "5177373c31318c3c6a190383bfd232e6cf565c36",
              "status": "affected",
              "version": "a4e7ba7027012f009f22a68bcfde670f9298d3a4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: xsk: rx: fix the frame\u0027s length check\n\nWhen calling buf_to_xdp, the len argument is the frame data\u0027s length\nwithout virtio header\u0027s length (vi-\u003ehdr_len). We check that len with\n\n\txsk_pool_get_rx_frame_size() + vi-\u003ehdr_len\n\nto ensure the provided len does not larger than the allocated chunk\nsize. The additional vi-\u003ehdr_len is because in virtnet_add_recvbuf_xsk,\nwe use part of XDP_PACKET_HEADROOM for virtio header and ask the vhost\nto start placing data from\n\n\thard_start + XDP_PACKET_HEADROOM - vi-\u003ehdr_len\nnot\n\thard_start + XDP_PACKET_HEADROOM\n\nBut the first buffer has virtio_header, so the maximum frame\u0027s length in\nthe first buffer can only be\n\n\txsk_pool_get_rx_frame_size()\nnot\n\txsk_pool_get_rx_frame_size() + vi-\u003ehdr_len\n\nlike in the current check.\n\nThis commit adds an additional argument to buf_to_xdp differentiate\nbetween the first buffer and other ones to correctly calculate the maximum\nframe\u0027s length."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malicious input is the used-ring length reported by the virtio-net backend (untrusted hypervisor/host, vDPA/VDUSE backend, or virtio offload hardware), which is local to the guest kernel rather than delivered over the network. A remote network peer cannot trigger it, since a conforming backend can never report more bytes than the posted buffer holds.\nAC:L - The backend fully and deterministically controls the reported length field and can set it to `frame_size + 2*hdr_len` on every received packet; there is no race, no memory-layout dependency, and no condition outside the attacker\u0027s control.\nPR:N - The attacking device backend needs no credentials or privileges inside the target guest \u2014 the overflow is processed automatically in the virtio-net NAPI RX path with no guest-side authentication or capability check.\nUI:N - No victim action is required; the malformed length is consumed by `virtnet_receive_xsk_buf()` during normal NAPI packet reception once an AF_XDP zero-copy pool is bound to the queue.\nS:U - The out-of-bounds read and the resulting disclosure/crash are confined to the guest kernel that owns the vulnerable driver, so the vulnerable and impacted components share the same security authority.\nC:H - `xdp-\u003edata_end` is pushed past the end of the XSK chunk, and `xsk_construct_skb()`/`xsk_append_merge_buffer()` copy that out-of-bounds memory into an skb that is delivered to the guest network stack or retransmitted via XDP_TX/XDP_REDIRECT, leaking adjacent memory repeatedly at packet rate.\nI:N - Both copy destinations (`napi_alloc_skb()` and `napi_alloc_frag()`) are sized from the same inflated length that is copied, so no out-of-bounds write or kernel data modification occurs \u2014 the defect is a read-side bounds error only.\nA:H - The umem is a `vmap()` of pinned user pages, so reading past the final chunk lands on a vmalloc guard page and produces an unhandled kernel page fault/oops (and a KASAN BUG on hardened kernels), crashing the guest."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:42.803Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/892f6ed9a4a38bb3360fdff091b9241cfa105b61"
        },
        {
          "url": "https://git.kernel.org/stable/c/6013bb6bc24c2cac3f45b37a15b71b232a5b00ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/5177373c31318c3c6a190383bfd232e6cf565c36"
        }
      ],
      "title": "virtio-net: xsk: rx: fix the frame\u0027s length check",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38413",
    "datePublished": "2025-07-25T13:20:17.394Z",
    "dateReserved": "2025-04-16T04:51:24.013Z",
    "dateUpdated": "2026-08-05T12:01:42.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38413",
      "date": "2026-09-19",
      "epss": "0.00165",
      "percentile": "0.06152"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/virtio_net.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "892f6ed9a4a38bb3360fdff091b9241cfa105b61",
                    "status": "affected",
                    "version": "a4e7ba7027012f009f22a68bcfde670f9298d3a4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6013bb6bc24c2cac3f45b37a15b71b232a5b00ff",
                    "status": "affected",
                    "version": "a4e7ba7027012f009f22a68bcfde670f9298d3a4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5177373c31318c3c6a190383bfd232e6cf565c36",
                    "status": "affected",
                    "version": "a4e7ba7027012f009f22a68bcfde670f9298d3a4",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/virtio_net.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.11"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.37",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.15.*",
                    "status": "unaffected",
                    "version": "6.15.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.16",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EE1FC310-514B-4D67-A65A-36DA37296733",
                    "versionEndExcluding": "6.12.37",
                    "versionStartIncluding": "6.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6E0BB4E0-44BC-4645-83A8-6EA232CE624C",
                    "versionEndExcluding": "6.15.6",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: xsk: rx: fix the frame\u0027s length check\n\nWhen calling buf_to_xdp, the len argument is the frame data\u0027s length\nwithout virtio header\u0027s length (vi-\u003ehdr_len). We check that len with\n\n\txsk_pool_get_rx_frame_size() + vi-\u003ehdr_len\n\nto ensure the provided len does not larger than the allocated chunk\nsize. The additional vi-\u003ehdr_len is because in virtnet_add_recvbuf_xsk,\nwe use part of XDP_PACKET_HEADROOM for virtio header and ask the vhost\nto start placing data from\n\n\thard_start + XDP_PACKET_HEADROOM - vi-\u003ehdr_len\nnot\n\thard_start + XDP_PACKET_HEADROOM\n\nBut the first buffer has virtio_header, so the maximum frame\u0027s length in\nthe first buffer can only be\n\n\txsk_pool_get_rx_frame_size()\nnot\n\txsk_pool_get_rx_frame_size() + vi-\u003ehdr_len\n\nlike in the current check.\n\nThis commit adds an additional argument to buf_to_xdp differentiate\nbetween the first buffer and other ones to correctly calculate the maximum\nframe\u0027s length."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: virtio-net: xsk: rx: correcci\u00f3n de la comprobaci\u00f3n de la longitud del marco. Al llamar a buf_to_xdp, el argumento len es la longitud de los datos del marco sin la longitud del encabezado de Virtio (vi-\u0026gt;hdr_len). Comprobamos esta longitud con xsk_pool_get_rx_frame_size() + vi-\u0026gt;hdr_len para garantizar que la longitud proporcionada no supere el tama\u00f1o del fragmento asignado. El valor adicional de vi-\u0026gt;hdr_len se debe a que, en virtnet_add_recvbuf_xsk, usamos parte de XDP_PACKET_HEADROOM para el encabezado de virtio y solicitamos al vhost que comience a colocar datos desde hard_start + XDP_PACKET_HEADROOM - vi-\u0026gt;hdr_len, no hard_start + XDP_PACKET_HEADROOM. Sin embargo, el primer b\u00fafer tiene virtio_header, por lo que la longitud m\u00e1xima del fotograma en el primer b\u00fafer solo puede ser xsk_pool_get_rx_frame_size(), no xsk_pool_get_rx_frame_size() + vi-\u0026gt;hdr_len, como en la comprobaci\u00f3n actual. Este commit a\u00f1ade un argumento adicional a buf_to_xdp para diferenciar entre el primer b\u00fafer y los dem\u00e1s y calcular correctamente la longitud m\u00e1xima del fotograma."
          }
        ],
        "id": "CVE-2025-38413",
        "lastModified": "2026-07-30T06:23:13.000",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-07-25T14:15:33.017",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5177373c31318c3c6a190383bfd232e6cf565c36"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6013bb6bc24c2cac3f45b37a15b71b232a5b00ff"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/892f6ed9a4a38bb3360fdff091b9241cfa105b61"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:07:52+00:00",
      "cve": "CVE-2025-38413",
      "id": "CVE-2025-38413",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: virtio-net: xsk: rx: fix the frame\u0027s length check",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38413.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.