Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can crash a system when SR-IOV virtual functions are created for the affected benet/be2net path. The business impact is mainly availability for hosts using this driver and SR-IOV. There is no cited evidence of active exploitation, and no CVSS score is provided.
Executive priority
Prioritize patching virtualization or network hosts that use SR-IOV with the affected Linux driver path. This is not currently evidenced as internet-exploited, but it can cause host instability where the affected configuration exists.
Technical view
The bug is in Linux kernel benet/be2net VF setup. be_cmd_set_mac_list() called dma_free_coherent() while under spin_lock_bh, leading to a kernel BUG in vunmap during SR-IOV VF creation. Stable kernel commits move the free operation until after the lock is released.
Likely exposure
Exposure appears limited to Linux systems on affected kernel versions where the benet/be2net driver path is present and SR-IOV VFs are created. Systems not using this driver or SR-IOV are less likely to encounter the crash based on the provided evidence.
Exploitation context
The source describes a reproducible kernel crash during VF creation, not a remote exploit. KEV is false, and the provided sources do not report active exploitation or public weaponization. Triggering appears tied to SR-IOV configuration activity on an affected host.
Researcher notes
The evidence supports an availability bug caused by freeing coherent DMA memory while a spin lock is held. The affected-version data is kernel-version and commit based. No CWE, CVSS vector, proof of exploitation, or non-Linux affected product evidence is provided.
Mitigation direction
- Update to a kernel release containing the stable fix for CVE-2025-38569.
- Review Debian LTS advisories if running Debian-packaged kernels.
- Check vendor kernel guidance for downstream fixed package versions.
- Avoid creating SR-IOV VFs on affected hosts until patched, where operationally feasible.
Validation and detection
- Inventory Linux kernel versions against the affected and fixed versions in the CVE record.
- Identify hosts using SR-IOV with the benet/be2net driver path.
- Confirm the applicable stable commit or downstream package fix is installed.
- Review kernel logs for BUG/Oops traces involving be2net, vunmap, or VF setup.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 3697e37e012b
- Linux stable commit 975e73b9102d
- Linux stable commit f80b34ebc579
- Linux stable commit 46d44a23a372
- Linux stable commit c377ba2be943
- Linux stable commit 0ddfe8b127ef
- Linux stable commit d5dc09ee5d74
- Linux stable commit f4e4e0c4bc4d
- Linux stable commit 5a40f8af2ba1
- Debian LTS advisory
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38569 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3697e37e012bbd2bb5a5b467689811ba097b2effCVE reference, Linux
- https://git.kernel.org/stable/c/975e73b9102d844a3dc3f091ad631c56145c8b4cCVE reference, Linux
- https://git.kernel.org/stable/c/f80b34ebc579216407b128e9d155bfcae875c30fCVE reference, Linux
- https://git.kernel.org/stable/c/46d44a23a3723a89deeb65b13cddb17f8d9f2700CVE reference, Linux
- https://git.kernel.org/stable/c/c377ba2be9430d165a98e4b782902ed630bc7546CVE reference, Linux
- https://git.kernel.org/stable/c/0ddfe8b127ef1149fddccb79db6e6eaba7738e7dCVE reference, Linux
- https://git.kernel.org/stable/c/d5dc09ee5d74277bc47193fe28ce8703e229331bCVE reference, Linux
- https://git.kernel.org/stable/c/f4e4e0c4bc4d799d6fa39055acdbc3af066cd13eCVE reference, Linux
- https://git.kernel.org/stable/c/5a40f8af2ba1b9bdf46e2db10e8c9710538fbc63CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.