CVE-2025-38375

virtio-net: ensure the received length does not exceed allocated size

State: Published
Severity: 8.4 High
Published: Jul 25, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

virtio-net: ensure the received length does not exceed allocated size

In xdp_linearize_page, when reading the following buffers from the ring, we forget to check the received length with the true allocate size. This can lead to an out-of-bound read. This commit adds that missing check.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4941d472bf95b4345d6e38906fcf354e74afa311 to before 773e95c268b5d859f51f7547559734fd2a57660cAffected 4941d472bf95b4345d6e38906fcf354e74afa311 to before ddc8649d363141fb3371dd81a73e1cb4ef8ed1e1Affected 4941d472bf95b4345d6e38906fcf354e74afa311 to before 982beb7582c193544eb9c6083937ec5ac1c9d651Affected 4941d472bf95b4345d6e38906fcf354e74afa311 to before 6aca3dad2145e864dfe4d1060f45eb1bac75dd58Affected 4941d472bf95b4345d6e38906fcf354e74afa311 to before 80b971be4c37a4d23a7f1abc5ff33dc7733d649bAffected 4941d472bf95b4345d6e38906fcf354e74afa311 to before bc68bc3563344ccdc57d1961457cdeecab8f81efAffected 4941d472bf95b4345d6e38906fcf354e74afa311 to before 11f2d0e8be2b5e784ac45fa3da226492c3e506d8Affected 4941d472bf95b4345d6e38906fcf354e74afa311 to before 315dbdd7cdf6aa533829774caaf4d25f1fd20e73Affected
LinuxLinux	4.14Affected before 4.14Not affected 5.4.297 through 5.4.Not affected 5.10.241 through 5.10.Not affected 5.15.189 through 5.15.Not affected 6.1.144 through 6.1.Not affected 6.6.97 through 6.6.Not affected 6.12.37 through 6.12.Not affected 6.15.6 through 6.15.*Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

4941d472bf95b4345d6e38906fcf354e74afa311 to before 773e95c268b5d859f51f7547559734fd2a57660cAffected
4941d472bf95b4345d6e38906fcf354e74afa311 to before ddc8649d363141fb3371dd81a73e1cb4ef8ed1e1Affected
4941d472bf95b4345d6e38906fcf354e74afa311 to before 982beb7582c193544eb9c6083937ec5ac1c9d651Affected
4941d472bf95b4345d6e38906fcf354e74afa311 to before 6aca3dad2145e864dfe4d1060f45eb1bac75dd58Affected
4941d472bf95b4345d6e38906fcf354e74afa311 to before 80b971be4c37a4d23a7f1abc5ff33dc7733d649bAffected
4941d472bf95b4345d6e38906fcf354e74afa311 to before bc68bc3563344ccdc57d1961457cdeecab8f81efAffected
4941d472bf95b4345d6e38906fcf354e74afa311 to before 11f2d0e8be2b5e784ac45fa3da226492c3e506d8Affected
4941d472bf95b4345d6e38906fcf354e74afa311 to before 315dbdd7cdf6aa533829774caaf4d25f1fd20e73Affected

LinuxLinux

4.14Affected
before 4.14Not affected
5.4.297 through 5.4.*Not affected
5.10.241 through 5.10.*Not affected
5.15.189 through 5.15.*Not affected
6.1.144 through 6.1.*Not affected
6.6.97 through 6.6.*Not affected
6.12.37 through 6.12.*Not affected
6.15.6 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.