Security readout for executives and security teams
Plain-English summary
A low-privileged local attacker could submit a maliciously structured IPv6 packet that overflows a 16-bit kernel header offset during segmentation. The demonstrated result was a kernel warning; the CVSS assessment indicates potentially serious confidentiality, integrity, and availability consequences. No user interaction is required.
Executive priority
Prioritize remediation in the normal high-severity patch cycle, accelerating internet infrastructure and shared compute environments with untrusted local workloads. This is not supported as an emergency remote-exploitation event, but potential kernel-level impact warrants prompt inventory, vendor verification, updating, and rebooting.
Technical view
Excessively long IPv6 extension headers can overflow skb->transport_header in ipv6_gso_segment(). The kernel fix adds a careful transport-header reset that rejects unsafe offsets. The supplied record scores this CVSS 3.1 at 7.8 with local access and low privileges required.
Likely exposure
Exposure applies to affected Linux kernels lacking the relevant stable fix or distribution backport. Risk is greatest where untrusted local users or workloads can reach the IPv6 packet-segmentation path. The supplied version data is irregular, so assess vendor kernels by advisory and backported commit status, not version strings alone.
Exploitation context
The issue was reproduced by syzbot using a crafted packet. The supplied record is not in KEV and provides no evidence of active exploitation or a public weaponized exploit. Local access and low privileges are reflected in the supplied CVSS vector; remotely reachable exploitation is not established.
Researcher notes
The demonstrated evidence shows an offset overflow and warning in ipv6_gso_segment(), not confirmed real-world compromise. No CWE is supplied. The affected-version list contains ambiguous entries, including “0” and “6.17”; authoritative distribution advisories and stable-commit backport checks are therefore essential for exposure decisions.
Mitigation direction
- Install the vendor-supported kernel update containing the applicable stable fix.
- Reboot into the updated kernel; installing a package alone may leave the vulnerable kernel running.
- If no update is available, obtain mitigation guidance from the Linux distribution vendor.
- Prioritize multi-user systems and hosts running untrusted workloads.
Validation and detection
- Record the running kernel version, build, and distribution package release.
- Check the distribution advisory for a backport of the referenced kernel fix.
- Confirm the applicable stable commit exists in custom kernel source or build metadata.
- After rebooting, verify the running kernel matches the remediated package.
- Review kernel logs for related warnings, without treating absence as proof of safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38572 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5dc60b2a00ed7629214ac0c48e43f40af2078703CVE reference, Linux
- https://git.kernel.org/stable/c/3f638e0b28bde7c3354a0df938ab3a96739455d1CVE reference, Linux
- https://git.kernel.org/stable/c/09ff062b89d8e48165247d677d1ca23d6d607e9bCVE reference, Linux
- https://git.kernel.org/stable/c/de322cdf600fc9433845a9e944d1ca6b31cfb67eCVE reference, Linux
- https://git.kernel.org/stable/c/ef05007b403dcc21e701cb1f30d4572ac0a9da20CVE reference, Linux
- https://git.kernel.org/stable/c/5489e7fc6f8be3062f8cb7e49406de4bfd94db67CVE reference, Linux
- https://git.kernel.org/stable/c/573b8250fc2554761db3bc2bbdbab23789d52d4eCVE reference, Linux
- https://git.kernel.org/stable/c/ee851768e4b8371ce151fd446d24bf3ae2d18789CVE reference, Linux
- https://git.kernel.org/stable/c/d45cf1e7d7180256e17c9ce88e32e8061a7887feCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.