CVE-2025-38413
virtio-net: xsk: rx: fix the frame's length check
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel, the following vulnerability has been resolved: virtio-net: xsk: rx: fix the frame's length check When calling buf_to_xdp, the len argument is the frame data's length
without virtio header's length (vi->hdr_len). We check that len with xsk_pool_get_rx_frame_size() + vi->hdr_len to ensure the provided len does not larger than the allocated chunk
size. The additional vi->hdr_len is because in virtnet_add_recvbuf_xsk,
we use part of XDP_PACKET_HEADROOM for virtio header and ask the vhost
to start placing data from hard_start + XDP_PACKET_HEADROOM - vi->hdr_len
not hard_start + XDP_PACKET_HEADROOM But the first buffer has virtio_header, so the maximum frame's length in
the first buffer can only be xsk_pool_get_rx_frame_size()
not xsk_pool_get_rx_frame_size() + vi->hdr_len like in the current check. This commit adds an additional argument to buf_to_xdp differentiate
between the first buffer and other ones to correctly calculate the maximum
frame's length.
In the Linux kernel, the following vulnerability has been resolved: virtio-net: xsk: rx: fix the...
CVSS Scores
SSVC
- Decision:-
Timeline
- 2025-04-16 CVE Reserved
- 2025-07-25 CVE Published
- 2025-07-28 CVE Updated
- 2025-07-31 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (4)
URL | Tag | Source |
---|---|---|
https://git.kernel.org/stable/c/a4e7ba7027012f009f22a68bcfde670f9298d3a4 | Vuln. Introduced |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 6.11 < 6.12.37 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.11 < 6.12.37" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 6.11 < 6.15.6 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.11 < 6.15.6" | en |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 6.11 < 6.16 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.11 < 6.16" | en |
Affected
|