Security readout for executives and security teams
Plain-English summary
A Linux networking flaw can crash the kernel when an ingress BPF program converts an IPv4 packet to IPv6 without safely handling existing routing information. Successful triggering could disrupt affected systems. The supplied evidence describes a specific local BPF/NAT46 scenario, not an ordinary remote network attack.
Executive priority
Treat as a high-priority stability risk on BPF-enabled networking systems, gateways, and appliances using protocol translation. Patch exposed systems promptly, but avoid assuming every Linux host is directly reachable through this flaw. No active exploitation is established by the supplied sources.
Technical view
BPF helpers that change skb protocol could leave an incompatible IPv4 destination attached after conversion to IPv6. IPv6 receive processing may then dereference invalid destination state in ip6_rcv_core, causing a kernel NULL-pointer fault. The kernel fix clears the destination while attempting to preserve metadata-only destinations.
Likely exposure
Prioritize Linux hosts that attach ingress BPF programs performing NAT46 or otherwise changing packet protocol. Exposure depends on affected kernel code and the ability to load or influence such programs. The supplied affected-version list is ambiguous, so distribution and appliance vendor backport status must be checked directly.
Exploitation context
The CVSS 3.1 score is 7.8 with local access, low complexity, low privileges, and no user interaction. The bundle does not establish active exploitation, and the CVE is not listed as KEV. Evidence demonstrates a kernel crash caused by unsafe BPF program behavior; broader confidentiality or integrity impact is not demonstrated.
Researcher notes
The failure occurs when protocol conversion leaves an IPv4 dst associated with an skb subsequently processed as IPv6. Remediation changes all relevant BPF protocol-changing helpers to clear routing destinations while preserving metadata destinations where possible. Exact vulnerable and fixed release boundaries are not reliably expressed in the supplied version data.
Mitigation direction
- Install a vendor kernel update containing the applicable stable fix or confirmed backport.
- Check Linux distribution and appliance advisories because version numbers alone may not reveal backported fixes.
- Disable unnecessary ingress NAT46 BPF programs that rewrite packet protocols until patch status is confirmed.
- Restrict authorization to load, attach, or modify networking BPF programs.
Validation and detection
- Inventory kernel builds and obtain vendor confirmation that CVE-2025-38192 is fixed.
- Identify ingress BPF programs that convert IPv4 packets to IPv6 or change skb protocol.
- Review kernel logs for NULL-pointer faults involving ip6_rcv_core or IPv6 receive processing.
- Verify the applicable vendor kernel includes one of the referenced stable fixes or an equivalent backport.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38192 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a046f183d21ab5ace5a96ece4cf9873a42f003a7CVE reference, Linux
- https://git.kernel.org/stable/c/98b1d8dc9a3170b2614f1e8c93854e75cdd83980CVE reference, Linux
- https://git.kernel.org/stable/c/bfa4d86e130a09f67607482e988313430e38f6c4CVE reference, Linux
- https://git.kernel.org/stable/c/2a3ad42a57b43145839f2f233fb562247658a6d9CVE reference, Linux
- https://git.kernel.org/stable/c/e9994e7b9f7bbb882d13c8191731649249150d21CVE reference, Linux
- https://git.kernel.org/stable/c/ba9db6f907ac02215e30128770f85fbd7db2fcf9CVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.