CVE-2025-38127
BaseFortify
Publication date: 2025-07-03
Last updated on: 2025-11-20
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a bug in the Linux kernel's ice driver related to the handling of Tx (transmit) scheduler errors in the XDP (eXpress Data Path) callback. When an XDP program is loaded, it adds new Tx queues and must update the Tx scheduler accordingly. If the Tx scheduler update fails, the XDP callback should fail and roll back any changes made. However, the previous implementation did not properly roll back all changes, causing a crash (general protection fault) in the kernel. The fix involves properly unmapping XDP queues and resetting pointers after failure, preventing the crash.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash due to improper error handling in the ice driver's XDP callback when updating Tx queues. Such a crash can lead to system instability, downtime, and potential loss of network functionality on affected systems using the ice driver with XDP programs.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring system logs for specific error messages related to the ice driver and XDP callback failures. Look for kernel log entries similar to: 'ice 0000:ca:00.0: Failed VSI LAN queue config for XDP, error: -5' and 'Oops: general protection fault, probably for non-canonical address'. You can use the command 'dmesg | grep ice' or 'journalctl -k | grep ice' to search for these errors in the kernel logs.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version that includes the fix for this vulnerability, which properly handles Tx scheduler errors in the XDP callback by rolling back changes and preventing crashes. Until the update is applied, avoid loading XDP programs that trigger the ice driver's Tx scheduler changes to prevent system crashes.