CVE-2025-38375

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-38375
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38375.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-38375
Downstream
Related
Published
2025-07-25T12:53:17Z
Modified
2026-08-12T03:51:36Z
Severity
  • 8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
virtio-net: ensure the received length does not exceed allocated size
Details

In the Linux kernel, the following vulnerability has been resolved:

virtio-net: ensure the received length does not exceed allocated size

In xdp_linearize_page, when reading the following buffers from the ring, we forget to check the received length with the true allocate size. This can lead to an out-of-bound read. This commit adds that missing check.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38375.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4941d472bf95b4345d6e38906fcf354e74afa311
Fixed
773e95c268b5d859f51f7547559734fd2a57660c
Fixed
ddc8649d363141fb3371dd81a73e1cb4ef8ed1e1
Fixed
982beb7582c193544eb9c6083937ec5ac1c9d651
Fixed
6aca3dad2145e864dfe4d1060f45eb1bac75dd58
Fixed
80b971be4c37a4d23a7f1abc5ff33dc7733d649b
Fixed
bc68bc3563344ccdc57d1961457cdeecab8f81ef
Fixed
11f2d0e8be2b5e784ac45fa3da226492c3e506d8
Fixed
315dbdd7cdf6aa533829774caaf4d25f1fd20e73

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38375.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.14.0
Fixed
5.4.297
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.241
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.189
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.144
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.97
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.37
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.15.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38375.json"