LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38413: virtio-net: xsk: rx: fix the frame's length check

In the Linux kernel, the following vulnerability has been resolved: virtio-net: xsk: rx: fix the frame's length check When calling buf_to_xdp, the len argument is the frame data's length without virtio header's length (vi->hdr_len). We check that len with xsk_pool_get_rx_frame_size() + vi->hdr_len to ensure the provided len does not larger than the allocated chunk size. The additional vi->hdr_len is because in virtnet_add_recvbuf_xsk, we use part of XDP_PACKET_HEADROOM for virtio header and ask the vhost to start placing data from hard_start + XDP_PACKET_HEADROOM - vi->hdr_len not hard_start + XDP_PACKET_HEADROOM But the first buffer has virtio_header, so the maximum frame's length in the first buffer can only be xsk_pool_get_rx_frame_size() not xsk_pool_get_rx_frame_size() + vi->hdr_len like in the current check. This commit adds an additional argument to buf_to_xdp differentiate between the first buffer and other ones to correctly calculate the maximum frame's length.

HighCVSS 7.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux virtio-net receive-path size check can accept a first buffer larger than its allocated AF_XDP frame. This could expose data or disrupt an affected system. The CVSS score is 7.7, but the supplied evidence describes local attack conditions and does not establish active exploitation.

Executive priority

Treat as a high-priority targeted kernel update, not an internet-wide emergency. Quickly identify hosts using the specific virtio-net AF_XDP path, obtain vendor-confirmed fixed builds, and prioritize sensitive or shared infrastructure. Escalate urgency if vendor intelligence later reports exploitation.

Technical view

In the virtio-net AF_XDP receive path, buf_to_xdp incorrectly allowed vi->hdr_len beyond the first buffer’s actual frame capacity. The correction distinguishes the first buffer from later buffers when calculating maximum frame length. CVSS 3.1 indicates local access, low complexity, no privileges or user interaction, with high confidentiality and availability impact.

Likely exposure

Exposure is limited to Linux systems using the affected virtio-net AF_XDP receive path. The bundle lists 6.11, 6.12.37, 6.15.6, and 6.16 as affected, but its version data is ambiguous and includes an unexplained “0.” Confirm exact distribution-specific ranges with the kernel vendor.

Exploitation context

The supplied record is not in CISA KEV and provides no evidence of exploitation in the wild or a public exploit. Its CVSS vector classifies attack access as local. The precise attacker prerequisites and practical trigger conditions are not established by the provided sources.

Researcher notes

The defective check compared a header-excluded len against frame size plus vi->hdr_len. Because the first receive buffer already contains the virtio header, its maximum frame data length is only xsk_pool_get_rx_frame_size(). The fix adds context to buf_to_xdp so first and subsequent buffers use different limits.

Mitigation direction

  • Identify systems using virtio-net with AF_XDP receive processing.
  • Consult the Linux distribution or kernel vendor for exact affected and fixed builds.
  • Upgrade to a vendor-supported kernel containing the cited frame-length correction.
  • Prioritize multi-tenant or sensitive hosts where confidentiality and availability impacts are material.

Validation and detection

  • Record kernel versions and distribution package revisions across potentially exposed hosts.
  • Confirm whether virtio-net and AF_XDP receive functionality are enabled and used.
  • Compare deployed kernel sources or vendor changelogs with the cited stable fixes.
  • After updating, verify the vendor package includes the corrected first-buffer length calculation.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38413 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.7 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.7CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H2.55.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.7High
CVSS 3.1 vector shape for CVE-2025-38413Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa4e7ba7027012f009f22a68bcfde670f9298d3a4, a4e7ba7027012f009f22a68bcfde670f9298d3a4, a4e7ba7027012f009f22a68bcfde670f9298d3a4unaffected
LinuxLinux6.11, 0, 6.12.37, 6.15.6, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.