CVE-2025-38238
BaseFortify
Publication date: 2025-07-09
Last updated on: 2025-11-19
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's fnic driver where, if both the RHBA and RPA FDMI requests time out, the driver reuses the same frame to send ABTS for both requests. When the send completes, the driver attempts to free the same frame twice, causing a crash. The fix involves allocating separate frames for RHBA and RPA and modifying the ABTS logic accordingly.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash due to a double free of a frame in the fnic driver when certain FDMI requests time out. Such crashes can lead to system instability or downtime, potentially affecting availability of services running on the affected system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can be performed by monitoring for crashes in the fnic driver related to FDMI timeouts, specifically looking for crashes in fnic_wq_cmpl_handler. Additionally, checking the MDS (Management Data Server) for FDMI information can help identify issues. However, no specific commands are provided.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves applying the fix that allocates separate frames for RHBA and RPA and modifies the ABTS logic accordingly to prevent double freeing of frames. Testing with an instrumented driver to simulate dropped responses (PLOGI, RHBA, RPA, and ABTS) can help verify the fix. No other specific mitigation steps or commands are provided.