Security readout for executives and security teams
Plain-English summary
A Linux network-driver flaw can leave stale receive-ring data after certain device resets, such as changing receive VLAN offload settings. The stale data can produce malformed network buffers and trigger a kernel failure. This may disrupt affected systems; the supplied CVSS assessment also indicates potential confidentiality and integrity impact.
Executive priority
Prioritize remediation for affected multi-user, privileged, or availability-sensitive Linux systems using libwx. The high 7.8 score warrants prompt action, but the local attack vector and absence of documented active exploitation do not support treating this as an internet-wide emergency.
Technical view
The libwx driver did not fully clear receive descriptors when wx->do_reset() reinitialized an Rx ring. Reusing residual descriptor values could build malformed socket buffers and reach a kernel BUG in __pskb_pull_tail through wx_clean_rx_irq. The cited Linux stable changes reset the descriptors to provide a clean ring state.
Likely exposure
Exposure is most likely where Linux uses the libwx driver with relevant network hardware and device resets can occur. The bundle identifies 6.3, 6.6.100, 6.12.40, 6.15.8, and 6.16 as affected, plus an ambiguous “0” entry. Distribution backports require vendor-specific verification.
Exploitation context
The supplied CVSS 3.1 vector describes local, low-complexity exploitation requiring low privileges and no user interaction. The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or a public exploit.
Researcher notes
The demonstrated consequence is a kernel crash caused by malformed SKBs after an Rx-ring reset. Although the CVSS vector claims high confidentiality, integrity, and availability impact, the supplied narrative does not explain data disclosure or modification paths. Exact vulnerable ranges and distribution backports remain insufficiently detailed.
Mitigation direction
- Inventory systems running listed kernel versions and using the libwx network driver.
- Install a distribution or vendor kernel incorporating the applicable cited Linux stable fix.
- Follow distribution security guidance where kernel version numbers differ because of backports.
- Until patched, restrict unnecessary low-privileged local access to affected systems.
- Avoid unnecessary Rx VLAN offload changes that trigger device resets, where operationally acceptable.
Validation and detection
- Record each system's running kernel version and determine whether active network interfaces use libwx.
- Confirm the installed kernel changelog references CVE-2025-38532 or an applicable cited stable commit.
- Test relevant device resets in staging and verify they no longer produce kernel failures.
- Review kernel logs for skbuff BUGs, invalid-opcode crashes, or traces involving wx_clean_rx_irq.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38532 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d510116c80b37efb100ce8d5ee326214b0157293CVE reference, Linux
- https://git.kernel.org/stable/c/10e27b2a6ebeda49e9c2897a699d3ce1ded565eeCVE reference, Linux
- https://git.kernel.org/stable/c/ee527d3fba4dae1d619d2d0438624002c8e99e24CVE reference, Linux
- https://git.kernel.org/stable/c/d992ed7e1b687ad7df0763d3e015a5358646210bCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.