Security readout for executives and security teams
Plain-English summary
A Linux VLAN bookkeeping flaw can leak memory or crash the kernel when receive-side VLAN filtering is changed while a network device is running. Exploitation requires local privileges and a specific VLAN configuration, but successful triggering could disrupt affected hosts.
Executive priority
Prioritize patching network infrastructure, virtualization hosts, and multi-user systems where delegated network administration exists. Treat internet-only exposure as lower because the documented trigger is local, but address promptly where a kernel crash could interrupt critical services.
Technical view
The 802.1Q subsystem can imbalance VLAN 0 references because removal depends on the current rx-vlan-filter state rather than whether VLAN 0 was automatically added at NETDEV_UP. Runtime filter changes can therefore leave an allocation unreleased or cause unregister_vlan_dev() to encounter missing VLAN information and trigger a kernel BUG.
Likely exposure
Exposure is most likely on affected Linux kernels where VLAN 0 and rx-vlan-filter are used on devices such as bonds or teams, particularly when filtering changes during runtime. The supplied record lists affected releases through 6.16, but distribution backports make package-level verification necessary.
Exploitation context
The CVSS vector indicates local, low-privileged access, low complexity, and no user interaction. The supplied sources show reproducible memory-leak and kernel-crash conditions. The CVE is not in KEV, and the bundle provides no evidence of active exploitation or a public weaponized exploit.
Researcher notes
The fix records whether VLAN 0 was automatically installed during NETDEV_UP and uses that state during NETDEV_DOWN, independent of the current filtering feature flag. The bundle demonstrates availability and resource-management failures; it does not establish practical confidentiality or integrity impact despite the CVSS vector.
Mitigation direction
- Apply the appropriate vendor kernel update containing the VLAN 0 reference-tracking fix.
- Confirm distribution-specific fixed package versions because stable fixes may be backported.
- Until patched, avoid changing rx-vlan-filter while affected network devices are running.
- Restrict local users and services permitted to administer network devices and VLAN configuration.
Validation and detection
- Inventory Linux kernel and distribution package versions across systems using VLAN networking.
- Identify hosts using VLAN 0, bonding, teaming, or rx-vlan-filter functionality.
- Compare installed kernels with vendor advisories or the applicable stable-kernel fix commit.
- After updating, verify the patched kernel is running following any required reboot.
- Review kernel logs for VLAN-related BUG, invalid opcode, KASAN, or memory-leak reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38470 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ba48d3993af23753e1f1f01c8d592de9c7785f24CVE reference, Linux
- https://git.kernel.org/stable/c/35142b3816832889e50164d993018ea5810955aeCVE reference, Linux
- https://git.kernel.org/stable/c/047b61a24d7c866c502aeeea482892969a68f216CVE reference, Linux
- https://git.kernel.org/stable/c/d43ef15bf4856c8c4c6c3572922331a5f06deb77CVE reference, Linux
- https://git.kernel.org/stable/c/bb515c41306454937464da055609b5fb0a27821bCVE reference, Linux
- https://git.kernel.org/stable/c/8984bcbd1edf5bee5be06ad771d157333b790c33CVE reference, Linux
- https://git.kernel.org/stable/c/93715aa2d80e6c5cea1bb486321fc4585076928bCVE reference, Linux
- https://git.kernel.org/stable/c/579d4f9ca9a9a605184a9b162355f6ba131f678dCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.