LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38331: net: ethernet: cortina: Use TOE/TSO on all TCP

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Use TOE/TSO on all TCP It is desireable to push the hardware accelerator to also process non-segmented TCP frames: we pass the skb->len to the "TOE/TSO" offloader and it will handle them. Without this quirk the driver becomes unstable and lock up and and crash. I do not know exactly why, but it is probably due to the TOE (TCP offload engine) feature that is coupled with the segmentation feature - it is not possible to turn one part off and not the other, either both TOE and TSO are active, or neither of them. Not having the TOE part active seems detrimental, as if that hardware feature is not really supposed to be turned off. The datasheet says: "Based on packet parsing and TCP connection/NAT table lookup results, the NetEngine puts the packets belonging to the same TCP connection to the same queue for the software to process. The NetEngine puts incoming packets to the buffer or series of buffers for a jumbo packet. With this hardware acceleration, IP/TCP header parsing, checksum validation and connection lookup are offloaded from the software processing." After numerous tests with the hardware locking up after something between minutes and hours depending on load using iperf3 I have concluded this is necessary to stabilize the hardware.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Affected Linux systems using the Cortina Ethernet driver can become unstable, lock up, or crash while processing TCP traffic. The issue threatens availability rather than data confidentiality or integrity. Exposure appears limited to systems using the relevant driver and hardware.

Executive priority

Treat confirmed affected systems as a high-priority availability risk, especially where they provide critical network services. Immediate estate-wide emergency action is not supported because exposure depends on specific hardware and driver use, and active exploitation is not documented.

Technical view

The driver did not send non-segmented TCP frames through the coupled TOE/TSO hardware-offload path. Testing described in the record found that disabling the TOE portion destabilized the hardware under TCP load. The correction applies TOE/TSO processing to all TCP frames by passing the frame length to the offloader.

Likely exposure

Likely exposure is limited to affected Linux kernels operating supported Cortina Ethernet hardware with the relevant driver active. Network-reachable TCP traffic can trigger the affected processing path. The supplied version data is ambiguous, so exact exposure must be confirmed against distribution advisories and corrected commits.

Exploitation context

The supplied record is not marked as KEV and provides no evidence of active exploitation or a public exploit. It reports reproducible lockups and crashes during sustained TCP performance testing. The CVSS assessment describes an unauthenticated, network-reachable availability impact, but malicious triggering is not demonstrated.

Researcher notes

The primary evidence supports a driver and hardware-offload stability defect with availability-only impact. The precise failure mechanism remains uncertain in the description. The supplied affected-version entries and repeated commit identifiers do not provide clean version boundaries; validate backports using distribution package records and the referenced stable commits.

Mitigation direction

  • Upgrade to a vendor-supported kernel release containing the applicable referenced stable fix.
  • Confirm the distribution's advisory maps the installed kernel build to a corrected commit.
  • Prioritize affected network-facing or availability-critical systems for maintenance.
  • If upgrading is delayed, request vendor-supported mitigations; none are documented in the supplied bundle.

Validation and detection

  • Inventory systems using the Cortina Ethernet driver and associated hardware.
  • Record exact kernel package versions and compare them with distribution advisories.
  • Confirm the applicable stable fix appears in source history or package changelogs.
  • Review monitoring and kernel logs for interface lockups or crashes during TCP traffic.
  • Test representative TCP workloads only in a controlled, non-production environment after remediation.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38331 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
7Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2025-38331Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88, 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88, 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88, 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88, 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88unaffected
LinuxLinux4.16, 0, 6.1.142, 6.6.95, 6.12.35, 6.15.4, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.