Security readout for executives and security teams
Plain-English summary
A flaw in Linux traffic-control processing can let a locally authenticated, low-privileged attacker corrupt kernel stack memory. Successful exploitation could compromise confidentiality, integrity, or availability. It is not remotely exploitable under the supplied CVSS assessment, but affected shared systems and hosts permitting local traffic-control access deserve prompt attention.
Executive priority
Treat this as a high-priority kernel update for exposed multi-user or shared Linux systems. It is less urgent than an internet-reachable unauthenticated flaw, but potential kernel compromise makes routine deferral inappropriate. Inventory affected kernels, identify systems granting relevant local access, and deploy vendor-supported updates through normal emergency patch governance.
Technical view
The mqprio traffic-control parser accepted queue index 16 although its stack array contains only elements 0–15. Processing that value causes a four-byte stack out-of-bounds write. The upstream correction limits the accepted index to TC_QOPT_MAX_QUEUE minus one. The supplied CVSS v3.1 score is 7.8: local access, low complexity, low privileges, and no user interaction.
Likely exposure
Exposure is limited to Linux systems running an affected kernel and reachable by a local user able to exercise the mqprio traffic-control path. The bundle lists several affected versions, but its version data includes an ambiguous “0” entry and provides no distribution-specific package mapping. Confirm exposure using each Linux distributor’s advisory and kernel build information.
Exploitation context
The supplied record does not establish active exploitation, and CVE-2025-38568 is not marked as CISA KEV. The impact assessment nevertheless indicates potential kernel-level confidentiality, integrity, and availability loss. Exploit reliability, practical privilege requirements, and public proof-of-concept availability are not established by the provided sources.
Researcher notes
The defect is a narrowly described four-byte stack overwrite caused by an inclusive netlink attribute maximum. The fix changes the maximum accepted index from 16 to 15. The sources do not provide crash behavior, exploit primitives, affected distribution packages, or evidence of exploitation. The supplied affected-version list should not be interpreted as reliable release ranges without vendor confirmation.
Mitigation direction
- Install a vendor-supported kernel containing the referenced upstream correction.
- Prioritize multi-user systems where untrusted local users can reach traffic-control configuration.
- Restrict unnecessary local access and mqprio configuration capability until patching is complete.
- Consult distribution guidance for exact fixed package versions before deployment.
- Reboot into the updated kernel when required by the vendor.
Validation and detection
- Record the running kernel version and distribution package release.
- Compare installed packages with the distributor’s CVE-2025-38568 advisory.
- Confirm the deployed kernel includes the applicable referenced stable commit.
- Verify systems rebooted into the corrected kernel after installation.
- Review whether untrusted local accounts can configure mqprio traffic control.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38568 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/39491e859fd494d0b51adc5c7d54c8a7dcf1d198CVE reference, Linux
- https://git.kernel.org/stable/c/d00e4125680f7074c4f42ce3c297336f23128e70CVE reference, Linux
- https://git.kernel.org/stable/c/66fc2ebdd9d5dd6e5a9c7edeace5a61a0ab2cd86CVE reference, Linux
- https://git.kernel.org/stable/c/f1a9dbcb7d17bf0abb325cdc984957cfabc59693CVE reference, Linux
- https://git.kernel.org/stable/c/ffd2dc4c6c49ff4f1e5d34e454a6a55608104c17CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.