Security readout for executives and security teams
Plain-English summary
A Linux Intel Ethernet driver flaw can leave XDP transmit queues partially configured after a scheduler failure. The resulting stale state can trigger a kernel protection fault and crash the host. Exploitation requires local, low-privileged access according to the supplied CVSS vector, so internet exposure alone is insufficient.
Executive priority
Prioritize affected high-availability, networking, and multi-user Linux hosts because a kernel crash can disrupt services. Accelerate remediation where untrusted local users can influence XDP configuration. Systems without the ice driver or XDP use are lower priority, but version and configuration evidence should support any exception.
Technical view
The ice driver’s XDP setup callback did not completely roll back changes after Tx scheduler or ring preparation failures. Released XDP queues could remain mapped to q_vectors, and the XDP rings pointer was not reset. Later packet-processing activity could dereference invalid state and cause a kernel general protection fault. The fix completes queue cleanup, clears the pointer, and exits immediately after preparation failure.
Likely exposure
Exposure is most plausible on Linux systems using the ice network driver where XDP programs are loaded or managed. The supplied data marks several kernel versions as affected, but its version formatting is ambiguous. Confirm the exact kernel build, driver usage, XDP configuration, and distribution advisory before declaring a host vulnerable.
Exploitation context
The supplied CVSS 3.1 score is 7.8 with local access, low complexity, low privileges, and no user interaction. The bundle documents a kernel crash during failed XDP queue configuration. It does not establish remote reachability or a reliable attack path. The CVE is not listed as KEV, and no supplied source reports active exploitation.
Researcher notes
The failure is an incomplete error-path rollback in ice XDP queue setup. The supplied trace demonstrates a general protection fault after VSI LAN queue configuration failed. Although the CVSS vector claims confidentiality, integrity, and availability impact, the narrative directly demonstrates only a crash. Exact vulnerable and fixed release boundaries cannot be reconstructed confidently from the flattened version list.
Mitigation direction
- Install a vendor-supported kernel containing the applicable linked stable fix.
- Check distribution or appliance guidance for the exact corrected release.
- Restrict who can load or reconfigure XDP programs until remediation.
- Avoid unsupported kernel builds where update provenance cannot be verified.
Validation and detection
- Inventory kernel versions and identify systems using the ice driver.
- Determine whether XDP programs are loaded on affected network interfaces.
- Map installed builds against vendor advisories and the linked stable commits.
- Review kernel logs for ice queue-configuration failures or protection faults.
- After updating, confirm the running kernel includes the applicable fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38127 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1d3c5d0dec6797eca3a861dab0816fa9505d9c3eCVE reference, Linux
- https://git.kernel.org/stable/c/276849954d7cbe6eec827b21fe2df43f9bf07011CVE reference, Linux
- https://git.kernel.org/stable/c/0e061abaad1498c5b76c10c594d4359ceb6b9145CVE reference, Linux
- https://git.kernel.org/stable/c/0153f36041b8e52019ebfa8629c13bf8f9b0a951CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.