Security readout for executives and security teams
Plain-English summary
A malformed MPLS packet processed by Linux kernel Open vSwitch can make its parser loop indefinitely after a label counter wraps. The affected CPU may become stuck, potentially degrading virtual networking or host availability. The supplied rating is CVSS 9.4 critical, but the description primarily demonstrates denial of service; it does not substantiate data theft.
Executive priority
Prioritize affected network virtualization, cloud, and container hosts because one malformed packet could impair packet processing or host availability. Patch promptly after confirming vendor packages, especially where untrusted MPLS traffic can reach Open vSwitch. Emergency incident response is not supported solely by current evidence because active exploitation is unreported.
Technical view
Open vSwitch kernel flow-key extraction parses an MPLS label stack that may lack a bottom-of-stack marker. With enough labels, the count wraps, creating a non-terminating loop and eventually a soft-lockup or CPU-stuck condition. The trace also records an array index of -1 in net/openvswitch/flow.c. Referenced Linux stable commits resolve the issue across branches.
Likely exposure
Likely exposure is limited to Linux systems using the kernel Open vSwitch datapath where MPLS packets can reach affected ports. Internet exposure depends on network architecture, not merely whether the host is internet-connected. Systems not using this datapath or not processing MPLS are less likely to be affected. Confirm exact kernel and vendor backport status because the supplied version data is ambiguous.
Exploitation context
The supplied CVSS vector describes network-reachable, low-complexity, unauthenticated exploitation without user interaction. However, the bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. The demonstrated outcome is CPU lockup and availability loss from unexpected MPLS input; confidentiality and integrity effects are not established by the description.
Researcher notes
The affected-version data is internally ambiguous: it mixes releases, “0,” duplicate commit identifiers, and an “unaffected” default. Validate branch-specific status through vendor backports. The description demonstrates a parser loop, soft lockup, and UBSAN out-of-bounds report. Although the supplied CVSS vector claims confidentiality and integrity impact, the narrative does not establish disclosure or modification. No CWE is supplied.
Mitigation direction
- Update to a distribution kernel incorporating the applicable referenced Linux stable fix.
- Verify the exact fixed package or backport through Linux distribution or vendor guidance.
- Until patched, restrict untrusted MPLS traffic from affected Open vSwitch paths where operationally feasible.
- Treat filtering as temporary; the source bundle identifies no vendor-endorsed workaround.
Validation and detection
- Inventory kernel versions and distribution package revisions on systems using Open vSwitch.
- Confirm whether the Open vSwitch kernel datapath is active and receives MPLS traffic.
- Match installed packages to vendor backport status or the applicable referenced stable commit.
- After remediation, verify updated kernels are running and review logs for soft-lockup or UBSAN events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38146 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H3.95.5LinuxVulnerability scoring details
Base CVSS 3.1 score
9.4CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4b9a086eedc1fddae632310386098c12155e3d0aCVE reference, Linux
- https://git.kernel.org/stable/c/ad17eb86d042d72a59fd184ad1adf34f5eb36843CVE reference, Linux
- https://git.kernel.org/stable/c/f26fe7c3002516dd3c288f1012786df31f4d89e0CVE reference, Linux
- https://git.kernel.org/stable/c/8ebcd311b4866ab911d1445ead08690e67f0c488CVE reference, Linux
- https://git.kernel.org/stable/c/69541e58323ec3e3904e1fa87a6213961b1f52f4CVE reference, Linux
- https://git.kernel.org/stable/c/3c1906a3d50cb94fd0a10e97a1c0a40c0f033cb7CVE reference, Linux
- https://git.kernel.org/stable/c/0bdc924bfb319fb10d1113cbf091fc26fb7b1f99CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.