Security readout for executives and security teams
Plain-English summary
A double-free defect in the Linux libwx network-driver library can corrupt kernel memory and crash affected systems. The supplied record rates it critical, but the technical description demonstrates a kernel panic rather than confirmed data theft or remote code execution. Exposure depends on the installed kernel and whether relevant libwx-based networking hardware is used.
Executive priority
Prioritize rapid assessment and patching on production Linux systems whose network interfaces rely on libwx, especially appliances requiring high availability. Do not assume every Linux host is exposed. Escalate emergency treatment where the affected driver is active and crashes would disrupt critical services; otherwise follow expedited kernel maintenance after confirming vendor applicability.
Technical view
An unnecessary page_pool_put_full_page() call could release an receive-buffer page twice instead of reusing it. The resulting page-pool and list corruption can trigger warnings and a kernel panic. Four Linux stable commits remove the redundant release. The bundle lists affected versions, but its version boundaries are ambiguous and should be reconciled with distribution advisories.
Likely exposure
Potentially exposed systems run an affected Linux kernel and use networking supported through libwx, including dependent drivers shown in the crash trace. The bundle identifies 6.3, 6.6.100, 6.12.40, 6.15.8, and 6.16 as affected, but also contains an unclear "0" entry and incomplete range semantics.
Exploitation context
The supplied record is not in KEV, and no cited source reports active exploitation or a public exploit. Although the supplied CVSS 9.8 vector claims network-accessible confidentiality, integrity, and availability impact, the included technical evidence establishes double-free corruption and kernel panic only. Treat broader impact as unconfirmed from this bundle.
Researcher notes
The root cause is a duplicate full-page return in an receive-buffer lifecycle where the page should normally be reused. The trace supports memory-list corruption followed by panic. Exact introduction and fixed-version boundaries cannot be confidently derived from the supplied affected-version array; analyze the referenced commits and downstream backport metadata before declaring a package vulnerable.
Mitigation direction
- Apply a distribution-supported kernel containing the applicable stable fix or backport.
- Check Linux vendor guidance to determine the corrected package for each deployed kernel branch.
- Prioritize network appliances and availability-sensitive hosts using libwx-dependent drivers.
- Use vendor-supported workarounds if immediate kernel replacement is unavailable; none are specified in this bundle.
Validation and detection
- Inventory kernel versions and identify systems with libwx or dependent network drivers loaded.
- Map installed distribution kernels to vendor advisories and the four referenced stable commits.
- Confirm the corrected kernel package is installed and active after reboot.
- Review kernel logs for page-pool errors, list corruption, warnings, or unexplained panics.
- Validate affected network interfaces under normal workloads after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38490 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3c91a56762b1f0d1e4af2d86c2cba83b61ed9eaaCVE reference, Linux
- https://git.kernel.org/stable/c/08d18bda0d03f5ec376929a8c6c4495f9594593aCVE reference, Linux
- https://git.kernel.org/stable/c/003e4765d8661be97e650a833868c53d35574130CVE reference, Linux
- https://git.kernel.org/stable/c/1b7e585c04cd5f0731dd25ffd396277e55fae0e6CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.