Security readout for executives and security teams
Plain-English summary
A flaw in the Linux fnic storage-network driver can crash the kernel when two FDMI requests time out together. The driver incorrectly reuses and then frees the same frame twice. Systems not using fnic are unlikely to reach the vulnerable path. The supplied sources establish a crash condition, but not successful code execution or data compromise.
Executive priority
Treat this as high priority for critical systems that actively use fnic because successful triggering can crash the kernel and disrupt storage-dependent workloads. Expedite inventory and vendor-supported updates there. Systems without fnic usage have substantially lower practical urgency, although affected kernel packages should still follow normal patch governance.
Technical view
Concurrent RHBA and RPA FDMI timeouts cause fnic to reuse one frame for separate ABTS operations. Completion processing then attempts to free that frame twice in fnic_wq_cmpl_handler, causing a kernel crash. The fix allocates separate frames and adjusts ABTS handling. The supplied CVSS is 8.8 with adjacent-network reachability, but the description demonstrates availability impact only.
Likely exposure
Exposure is concentrated in Linux systems running an affected kernel and actively using the fnic driver. The supplied affected-version metadata names 6.14, 6.15.5, and 6.16, but its version formatting is ambiguous. Confirm applicability against the distribution or kernel vendor’s advisory and fix backports rather than relying solely on version numbers.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. Triggering requires both RHBA and RPA FDMI requests to time out, followed by completion of reused ABTS frame handling. Whether an untrusted adjacent party can reliably induce those conditions is not established by the bundle.
Researcher notes
The demonstrated root cause is a double free in completion handling after simultaneous FDMI timeouts. The source reports testing across dropped PLOGI, RHBA, RPA, and ABTS responses. Although the CVSS vector assigns high confidentiality and integrity impacts, the supplied narrative documents a crash only; broader security impact and attacker-controlled reachability remain unproven.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced fnic fix.
- Check distribution advisories for backported fixes before comparing kernel version numbers.
- Prioritize systems actively using fnic in operationally critical storage environments.
- If immediate updating is impossible, consult vendor guidance for safe exposure-reduction options.
Validation and detection
- Inventory affected Linux hosts and identify whether the fnic driver is loaded or configured.
- Record kernel package versions and compare them with distribution-specific security advisories.
- Verify the installed kernel includes an applicable referenced stable fix or vendor backport.
- Review kernel logs for fnic crashes, FDMI timeouts, ABTS failures, or double-free indicators.
- After updating, confirm normal FDMI discovery and storage connectivity under approved testing.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38238 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/09679e9abedfbc5a2590759a1a7893c1c26e6044CVE reference, Linux
- https://git.kernel.org/stable/c/a35b29bdedb4d2ae3160d4d6684a6f1ecd9ca7c2CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.