In the Linux kernel, the following vulnerability has been resolved:
virtio-net: ensure the received length does not exceed allocated size
In xdplinearizepage, when reading the following buffers from the ring, we forget to check the received length with the true allocate size. This can lead to an out-of-bound read. This commit adds that missing check.
[
{
"id": "CVE-2025-38375-02fcb7d8",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "receive_small",
"file": "drivers/net/virtio_net.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@773e95c268b5d859f51f7547559734fd2a57660c",
"digest": {
"length": 2903.0,
"function_hash": "33606798758828897492890056139928833975"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38375-074c6df9",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/virtio_net.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80b971be4c37a4d23a7f1abc5ff33dc7733d649b",
"digest": {
"line_hashes": [
"179789054609223353664800841092306696210",
"321797204012735840957358996920452906555",
"140720078121250385893977648957201223776",
"146728430653580255137869145113070004701",
"60574199662867898068773081622263379773",
"14555722898917225935828996145361957300",
"124964192583688973453602901302893027014",
"249109180150736539110559046627690013129",
"75988218975556560049205374974213488025",
"254261443186304108643732829454323239404",
"27081804728838908872819318802395406092",
"156190544460751685189505277381912585605",
"321838018926181571752529423332875339103",
"217357756808880516274471856783274603399",
"33536613786882913202238625602759249359",
"109204467793062489302692310587056528944",
"150020306696043005480662813288005724039",
"163983942411015738335396237323876924138",
"66599238407950785425047912298747939650",
"94988479165472226407427539877365113689",
"336503113165629472137203328179346571123",
"3298306707149297491864586557467047160",
"4490854019629053283738306535832543364",
"98816509030199234658624918627982340367",
"324894401713258613035994778496657267777",
"332924416930620496042622542222853827453",
"51504733750989234202031649733413920298"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2025-38375-2b9cb696",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "mergeable_xdp_get_buf",
"file": "drivers/net/virtio_net.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80b971be4c37a4d23a7f1abc5ff33dc7733d649b",
"digest": {
"length": 1166.0,
"function_hash": "283220229516007957695123679479816561464"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38375-57150062",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "xdp_linearize_page",
"file": "drivers/net/virtio_net.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80b971be4c37a4d23a7f1abc5ff33dc7733d649b",
"digest": {
"length": 905.0,
"function_hash": "333088861166092821339055290569275924515"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38375-6e0eed17",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/virtio_net.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@773e95c268b5d859f51f7547559734fd2a57660c",
"digest": {
"line_hashes": [
"78543209637703565339559229256119080722",
"126440795945520339444087502046639373422",
"158383811602032268286500043886963488941",
"146728430653580255137869145113070004701",
"44825989256273381163261387721163167708",
"252447088655786669434802356150508345213",
"276880561186991650175447394290023064404",
"249109180150736539110559046627690013129",
"75988218975556560049205374974213488025",
"254261443186304108643732829454323239404",
"27081804728838908872819318802395406092",
"30403977548369735018368367839859100255",
"21202059285694855366194525779482194553",
"107585289827930764602219787256154304197",
"283331572931175449366012807456974589248",
"109204467793062489302692310587056528944",
"150020306696043005480662813288005724039",
"163983942411015738335396237323876924138",
"66599238407950785425047912298747939650",
"94988479165472226407427539877365113689",
"336503113165629472137203328179346571123",
"3298306707149297491864586557467047160",
"4490854019629053283738306535832543364",
"170634583457978091520471715865036787444",
"30448385715203805309298132719483189354",
"44686174449686964010230885257288219971",
"324224897186750274139241946371154502118"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2025-38375-71523f7d",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "receive_mergeable",
"file": "drivers/net/virtio_net.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@773e95c268b5d859f51f7547559734fd2a57660c",
"digest": {
"length": 4524.0,
"function_hash": "66012686157139536329714118554894098270"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38375-7e655694",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "mergeable_xdp_get_buf",
"file": "drivers/net/virtio_net.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc68bc3563344ccdc57d1961457cdeecab8f81ef",
"digest": {
"length": 1166.0,
"function_hash": "18290307569756475917134419693918230676"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38375-8a9f856f",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "receive_small_xdp",
"file": "drivers/net/virtio_net.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80b971be4c37a4d23a7f1abc5ff33dc7733d649b",
"digest": {
"length": 1796.0,
"function_hash": "170508939971651309177331133693774972027"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38375-8e2c6aaf",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/virtio_net.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc68bc3563344ccdc57d1961457cdeecab8f81ef",
"digest": {
"line_hashes": [
"179789054609223353664800841092306696210",
"321797204012735840957358996920452906555",
"140720078121250385893977648957201223776",
"311824042822883164972426329437678037667",
"37184883840602844463741459319457522791",
"14555722898917225935828996145361957300",
"124964192583688973453602901302893027014",
"249109180150736539110559046627690013129",
"75988218975556560049205374974213488025",
"254261443186304108643732829454323239404",
"27081804728838908872819318802395406092",
"156190544460751685189505277381912585605",
"321838018926181571752529423332875339103",
"217357756808880516274471856783274603399",
"33536613786882913202238625602759249359",
"109204467793062489302692310587056528944",
"150020306696043005480662813288005724039",
"163983942411015738335396237323876924138",
"66599238407950785425047912298747939650",
"94988479165472226407427539877365113689",
"336503113165629472137203328179346571123",
"3298306707149297491864586557467047160",
"4490854019629053283738306535832543364",
"98816509030199234658624918627982340367",
"324894401713258613035994778496657267777",
"243860532838221478166050076896622370951",
"51495200882040644098358091417112413005"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2025-38375-cb442bc5",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "xdp_linearize_page",
"file": "drivers/net/virtio_net.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@773e95c268b5d859f51f7547559734fd2a57660c",
"digest": {
"length": 904.0,
"function_hash": "75411946489783311361485030802414113466"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38375-dde97bd9",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "receive_small_xdp",
"file": "drivers/net/virtio_net.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc68bc3563344ccdc57d1961457cdeecab8f81ef",
"digest": {
"length": 1796.0,
"function_hash": "170508939971651309177331133693774972027"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-38375-e0ddf17c",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "xdp_linearize_page",
"file": "drivers/net/virtio_net.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc68bc3563344ccdc57d1961457cdeecab8f81ef",
"digest": {
"length": 905.0,
"function_hash": "281385380343159012418178141706456951450"
},
"signature_type": "Function"
}
]