Security readout for executives and security teams
Plain-English summary
A Linux fbnic network-driver error can leave a queue pointing to freed NAPI data after the device fails to open. Later AF_XDP binding may access that stale pointer, causing a use-after-free. The supplied CVSS is 7.8, but the evidence describes a CI-discovered failure, not confirmed real-world exploitation.
Executive priority
Treat as a high-priority kernel maintenance issue on systems using fbnic and AF_XDP, especially multi-user or untrusted-workload hosts. Prioritize exposure discovery and vendor-supported updates. Broader emergency action is not supported by the supplied evidence because active exploitation is unconfirmed and the triggering configuration appears specialized.
Technical view
The fbnic open-error path failed to clear NAPI pointers from queues after NAPI objects were freed. A subsequent xsk_bind() could reach __sk_mark_napi_id_once() through the stale pointer, producing a use-after-free. The record identifies Linux kernel releases including 6.14, 6.15.10, 6.16.1, and 6.17 as affected, but provides ambiguous version boundaries.
Likely exposure
Exposure appears limited to Linux systems using the fbnic driver where AF_XDP queue binding follows a failed device-open operation. Systems without relevant fbnic hardware, driver use, or AF_XDP activity are less likely exposed. The supplied version data is ambiguous, so kernel vendor advisories should determine exact applicability.
Exploitation context
The CVSS vector indicates a local, low-complexity attack requiring low privileges and no user interaction, with potentially high confidentiality, integrity, and availability impact. However, the source bundle provides no proof of practical exploitation, no public exploit evidence, and no CISA KEV listing.
Researcher notes
The observed failure occurred during AF_XDP testing after an earlier device-open failure. The core invariant violation is a queue retaining a pointer to freed NAPI state. The bundle supplies three stable-kernel commits but does not map them clearly to fixed releases. CVSS impact claims should not be treated as demonstrated exploit outcomes.
Mitigation direction
- Identify systems loading or using the fbnic network driver.
- Check distribution or kernel-vendor advisories for affected and corrected package versions.
- Upgrade to a vendor-supported kernel incorporating the referenced correction.
- Restrict unnecessary local access and AF_XDP capabilities until remediation is confirmed.
- Prioritize systems where fbnic device-open failures have occurred.
Validation and detection
- Record running kernel and installed kernel package versions.
- Confirm whether fbnic is present, loaded, or bound to hardware.
- Determine whether workloads use AF_XDP on affected interfaces.
- Review logs for fbnic open failures, crashes, or memory-safety reports.
- Verify the installed kernel contains the applicable stable correction.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38570 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/21d3f8441c7f317b93ba6a8029610c8b7e3773dbCVE reference, Linux
- https://git.kernel.org/stable/c/4b59f9deff3bdb52b223c85048f1d2924803b817CVE reference, Linux
- https://git.kernel.org/stable/c/4b31bcb025cb497da2b01f87173108ff32d350d2CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.