Security readout for executives and security teams
Plain-English summary
CVE-2025-38165 is a Linux kernel availability flaw. Under specific BPF sockmap and stream-parser conditions, sufficiently large aggregated network data can trigger a kernel panic, crashing the host. The cited evidence does not indicate data theft, data modification, or observed attacks in the wild.
Executive priority
Treat this as a high-priority availability patch for systems using BPF sockmap. Accelerate exposed or operationally critical hosts; validate other Linux assets against vendor guidance before scheduling updates.
Technical view
A reference-counting change made an skb shared before skb_linearize processed it, triggering a BUG_ON assertion. The condition occurs in the sockmap receive path when stream parsing aggregates data beyond MAX_MSG_FRAGS. The upstream correction moves skb_get into sk_psock_skb_ingress_enqueue and adds take_ref control for paths that do not require the reference.
Likely exposure
Exposure is concentrated in Linux systems using the affected BPF sockmap receive path with stream parsing. The supplied version representation mixes releases and commit identifiers and does not establish dependable affected-to-fixed boundaries. Confirm each distribution kernel and any backported fix with its vendor.
Exploitation context
The CVSS 3.1 score is 7.5, with network reachability, low complexity, no privileges, and availability impact only. Researchers reproduced a kernel panic, but the bundle reports KEV as false and provides no evidence of active exploitation or a publicly weaponized exploit.
Researcher notes
The crash mechanism and code-level correction are well documented. Exact exposure remains configuration-dependent, and the normalized version data is insufficient for definitive boundary analysis. No confidentiality or integrity effect is stated. Absence from KEV is not proof that exploitation cannot occur.
Mitigation direction
- Check Linux or distribution advisories for an authoritative affected-version mapping.
- Install a vendor kernel update containing the referenced upstream fix or an approved backport.
- Reboot where required and verify the updated kernel is running.
- If patching is delayed, seek vendor-supported mitigations; the sources name no temporary workaround.
Validation and detection
- Inventory running kernel builds on systems using BPF sockmap or stream parsing.
- Confirm each running build contains a referenced fix commit or vendor-equivalent backport.
- Review kernel logs for skbuff BUG assertions and sk_psock_backlog panic traces.
- Validate the updated kernel under representative sockmap traffic in a controlled staging environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38165 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4dba44333a11522df54b49aa1f2edfaf6ce35fc7CVE reference, Linux
- https://git.kernel.org/stable/c/9718ba6490732dbe70190d42c21deb1440834402CVE reference, Linux
- https://git.kernel.org/stable/c/db1d15a26f21f97459508c42ae87cabe8d3afc3bCVE reference, Linux
- https://git.kernel.org/stable/c/3d25fa2d7f127348c818e1dab9e58534f7ac56ccCVE reference, Linux
- https://git.kernel.org/stable/c/e9c1299d813fc04668042690f2c3cc76d013959aCVE reference, Linux
- https://git.kernel.org/stable/c/5ca2e29f6834c64c0e5a9ccf1278c21fb49b827eCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.