Security readout for executives and security teams
Plain-English summary
A race during mobile-broadband disconnection can leave the Linux MediaTek t7xx WWAN driver processing received data through a network device that has already been released. The documented result is a NULL-pointer dereference and kernel panic, causing system disruption. Exposure appears limited to systems using this driver and the affected kernel code.
Executive priority
Treat as urgent for systems using MediaTek t7xx mobile broadband, especially where unexpected reboot or downtime affects critical operations. It is not supported as an organization-wide Linux emergency without confirming driver presence. The supplied critical score warrants attention, but the public technical evidence currently establishes kernel panic rather than complete system compromise.
Technical view
During NAPI receive polling, user-plane disconnect logic can release the netdev while queued packet processing continues. The t7xx receive path then passes an invalid netdev into GRO processing, producing a NULL-pointer dereference in dev_gro_receive. The supplied description demonstrates an availability failure; it does not establish the claimed confidentiality or integrity impacts.
Likely exposure
Potentially exposed systems run Linux with the MediaTek t7xx WWAN driver and exercise its user-plane disconnect path while receive polling is active. The supplied affected-version metadata includes 6.2, 6.6.94, 6.12.34, 6.15.3, and 6.16, but does not provide clear affected-to-fixed ranges. Distribution-specific confirmation is required.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. The documented trigger involves a timing-dependent disconnect and receive-polling race. Remote reachability and attacker-controlled confidentiality or integrity impact are not demonstrated by the supplied sources.
Researcher notes
The core issue appears to be netdev lifetime synchronization between disconnect-driven dellink processing and NAPI receive polling. Stable-kernel commit references indicate fixes exist, but the bundle does not explain branch mapping or exact fixed releases. The CVSS 9.8 vector claims full confidentiality, integrity, and availability impact, while the description and trace substantiate availability impact only.
Mitigation direction
- Apply a distribution or kernel update incorporating the referenced stable fixes.
- Confirm fixed package versions with the operating-system or appliance vendor.
- Limit use of affected t7xx WWAN interfaces until updating, where operationally practical.
- Prioritize resilient or safety-sensitive systems where a kernel panic has significant consequences.
Validation and detection
- Inventory systems loading or shipping the MediaTek t7xx WWAN driver.
- Map deployed kernel builds against vendor advisories and the referenced stable commits.
- Review kernel logs for t7xx, dev_gro_receive, or NULL-pointer panic traces.
- Safely test WWAN disconnect handling in a controlled, non-production environment after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38123 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/cc89f457d9133a558d4e8ef26dc20843c2d12073CVE reference, Linux
- https://git.kernel.org/stable/c/e2df04e69c3f10b412f54be036dd0ed3b14756cfCVE reference, Linux
- https://git.kernel.org/stable/c/66542e9430c625f878a5b5dc0fe41e3458d614bfCVE reference, Linux
- https://git.kernel.org/stable/c/905fe0845bb27e4eed2ca27ea06e6c4847f1b2b1CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.