Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw can leave a netfilter hook in an inconsistent state when a device is duplicated during a ruleset update. A local low-privileged actor may trigger the vulnerable operation without user interaction. The supplied CVSS rating indicates potentially serious confidentiality, integrity, and availability impact, although the bundle documents a kernel warning rather than a demonstrated compromise.
Executive priority
Prioritize assessment and patching as a high-severity local kernel issue, especially on shared Linux infrastructure. Internet exposure alone does not establish reachability. Require platform owners to verify vendor backports and local access conditions. Escalate urgently if untrusted users can exercise nf_tables operations; otherwise remediate through the normal high-priority kernel maintenance process.
Technical view
During an nf_tables chain or flowtable update, duplicate devices can enter the same transaction batch. The netdev event path removes only the first matching device, leaving the duplicate device's hook unregistered and triggering a warning during hook removal. The kernel fix rejects duplicate devices in the transaction with EEXIST.
Likely exposure
The bundle marks Linux as affected and lists 5.8, 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.59, 6.16.2, and 6.17. Exact affected ranges are not clearly expressed. Exposure requires local, low-privileged access to the vulnerable nf_tables update path. Confirm distribution kernel versions and backports rather than relying only on upstream version numbers.
Exploitation context
The CVSS vector is local, low complexity, low privilege, and requires no user interaction. The supplied record does not establish active exploitation, and the CVE is not identified as being in KEV. No public proof of exploitation is included. Treat the stated high confidentiality, integrity, and availability impacts as rating data, not demonstrated outcomes.
Researcher notes
The source establishes a duplicate-device transaction flaw, incomplete hook cleanup, and an upstream rejection fix. It does not explain how the warning produces the CVSS-rated confidentiality, integrity, and availability consequences. The affected-version presentation is ambiguous and includes a repeated commit identifier under an unaffected entry. Branch-specific fix commits should be matched against each deployed kernel's ancestry or vendor changelog.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable stable fix.
- Check distribution security guidance for backported fixes and precise affected package versions.
- Restrict unnecessary local access to nf_tables administration until remediation is confirmed.
- Prioritize shared or multi-user Linux systems where untrusted local users can reach netfilter functionality.
Validation and detection
- Inventory running kernel and distribution package versions across Linux systems.
- Confirm the installed package includes the relevant upstream fix or vendor backport.
- Identify users and workloads able to perform nf_tables chain or flowtable updates.
- Review kernel logs for related nf_hook_entry_head warnings, without treating absence as proof of safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38678 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0521e694d5b80899fba8695881a6349f9bc538cbCVE reference, Linux
- https://git.kernel.org/stable/c/4681960bc0f4f8bcc782cbf2fd205f48ad314dfdCVE reference, Linux
- https://git.kernel.org/stable/c/4ce2a0c3b8497a66cfc25fc7ca3d087258a785d2CVE reference, Linux
- https://git.kernel.org/stable/c/3f358a66a04513311668ea4b40f5064e253d8386CVE reference, Linux
- https://git.kernel.org/stable/c/cf23d531a9d496863aa4c5a0e2f71f0a23f3df3cCVE reference, Linux
- https://git.kernel.org/stable/c/d7615bde541f16517d6790412da6ec46fa8a4c1fCVE reference, Linux
- https://git.kernel.org/stable/c/cf5fb87fcdaaaafec55dcc0dc5a9e15ead343973CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.