CVE-2025-38019
BaseFortify
Publication date: 2025-06-18
Last updated on: 2025-11-14
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free bug in the Linux kernel's mlxsw driver related to GRE (Generic Routing Encapsulation) net devices. When the driver reloads, it incorrectly offloads neighbors on GRE devices that it normally would not, and if such a neighbor is deleted, the driver ignores the deletion notification but continues to reference freed memory. This leads to a use-after-free condition, which can cause kernel crashes or other unpredictable behavior.
How can this vulnerability impact me? :
The use-after-free vulnerability can lead to kernel crashes or instability in systems using the affected mlxsw driver with GRE net devices. This could result in denial of service or potentially allow attackers to exploit the kernel memory corruption for further attacks, depending on the system context.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking for GRE net devices and their neighbors that are not offloaded, then observing if after a driver reload the neighbors become offloaded incorrectly. Suggested commands include: # ip link add name gre1 up type gre tos inherit local 192.0.2.1 remote 198.51.100.1 # ip neigh add 0.0.0.0 lladdr 0.0.0.0 nud noarp dev gre1 $ ip neigh show dev gre1 nud noarp # devlink dev reload pci/0000:01:00.0 $ ip neigh show dev gre1 nud noarp If after reloading the driver the neighbor is marked as 'offload' on the GRE device, this indicates the vulnerable behavior.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves avoiding deletion of GRE net devices with neighbors that may be offloaded incorrectly after driver reload. Applying the fix that skips neighbor replay if the net device is not an upper of the driver is necessary. Until the fix is applied, carefully manage GRE net devices and avoid driver reloads that replay neighbors on GRE devices to prevent use-after-free conditions.