LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38683: hv_netvsc: Fix panic during namespace deletion with VF

In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, default_device_exit_batch() >> default_device_exit_net() is called. When netvsc NIC is moved back and registered to the default namespace, it automatically brings VF NIC back to the default namespace. This will cause the default_device_exit_net() >> for_each_netdev_safe loop unable to detect the list end, and hit NULL ptr: [ 231.449420] mana 7870:00:00.0 enP30832s1: Moved VF to namespace with: eth0 [ 231.449656] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 231.450246] #PF: supervisor read access in kernel mode [ 231.450579] #PF: error_code(0x0000) - not-present page [ 231.450916] PGD 17b8a8067 P4D 0 [ 231.451163] Oops: Oops: 0000 [#1] SMP NOPTI [ 231.451450] CPU: 82 UID: 0 PID: 1394 Comm: kworker/u768:1 Not tainted 6.16.0-rc4+ #3 VOLUNTARY [ 231.452042] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/21/2024 [ 231.452692] Workqueue: netns cleanup_net [ 231.452947] RIP: 0010:default_device_exit_batch+0x16c/0x3f0 [ 231.453326] Code: c0 0c f5 b3 e8 d5 db fe ff 48 85 c0 74 15 48 c7 c2 f8 fd ca b2 be 10 00 00 00 48 8d 7d c0 e8 7b 77 25 00 49 8b 86 28 01 00 00 <48> 8b 50 10 4c 8b 2a 4c 8d 62 f0 49 83 ed 10 4c 39 e0 0f 84 d6 00 [ 231.454294] RSP: 0018:ff75fc7c9bf9fd00 EFLAGS: 00010246 [ 231.454610] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 61c8864680b583eb [ 231.455094] RDX: ff1fa9f71462d800 RSI: ff75fc7c9bf9fd38 RDI: 0000000030766564 [ 231.455686] RBP: ff75fc7c9bf9fd78 R08: 0000000000000000 R09: 0000000000000000 [ 231.456126] R10: 0000000000000001 R11: 0000000000000004 R12: ff1fa9f70088e340 [ 231.456621] R13: ff1fa9f70088e340 R14: ffffffffb3f50c20 R15: ff1fa9f7103e6340 [ 231.457161] FS: 0000000000000000(0000) GS:ff1faa6783a08000(0000) knlGS:0000000000000000 [ 231.457707] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 231.458031] CR2: 0000000000000010 CR3: 0000000179ab2006 CR4: 0000000000b73ef0 [ 231.458434] Call Trace: [ 231.458600] <TASK> [ 231.458777] ops_undo_list+0x100/0x220 [ 231.459015] cleanup_net+0x1b8/0x300 [ 231.459285] process_one_work+0x184/0x340 To fix it, move the ns change to a workqueue, and take rtnl_lock to avoid changing the netdev list when default_device_exit_net() is using it.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel flaw can crash an affected virtualized host during network namespace cleanup when Hyper-V netvsc and a VF network device interact. The business impact is availability loss, not confirmed data theft or remote compromise. Public sources show a kernel fix exists, but provide no CVSS score and no evidence of active exploitation.

Executive priority

Treat as a targeted availability risk for affected Linux virtualization environments. Prioritize patching where Hyper-V networking and VF acceleration support production workloads. It does not currently warrant emergency response absent exposure evidence, crashes, or vendor escalation.

Technical view

The bug is a NULL pointer dereference in Linux network namespace cleanup. When a netvsc NIC returns to the default namespace, the VF NIC is also moved, altering the netdev list while default_device_exit_net() iterates it. The upstream fix moves namespace change handling to a workqueue and uses rtnl_lock.

Likely exposure

Most relevant to Linux systems running affected kernel versions with Hyper-V hv_netvsc, SR-IOV or VF networking, and network namespace lifecycle activity. Container hosts and virtualized workloads using these paths deserve review. Systems without this driver and VF namespace movement appear less likely exposed based on the supplied description.

Exploitation context

KEV is false and the provided sources do not report active exploitation. The described failure is a kernel panic during namespace deletion, suggesting an availability issue triggered by specific local networking conditions rather than a broadly documented remote attack path.

Researcher notes

The affected-version data mixes commit identifiers and release numbers, so validation should rely on vendor backports and fixed package metadata, not version strings alone. The root issue is concurrent netdev list mutation during namespace cleanup, addressed by deferred work and rtnl_lock serialization.

Mitigation direction

  • Apply kernel updates containing the referenced stable fixes.
  • Use distribution advisories to identify fixed kernel packages.
  • Prioritize Hyper-V Linux hosts using netvsc with VF networking.
  • Plan required reboots after kernel package installation.
  • If fixed packages are unavailable, follow vendor guidance.

Validation and detection

  • Inventory Linux kernel versions against the affected version list.
  • Identify hosts using hv_netvsc and VF or SR-IOV networking.
  • Review kernel logs for NULL pointer dereferences in default_device_exit_batch.
  • Confirm deployed kernels include the relevant stable commit or vendor backport.
  • Check Debian LTS and vendor advisories for package status.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38683 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
12Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3eb6aa870057da9f1304db660f68b9c2eb7e856d, b7a396f76ada277d049558db648389456458af65, 4faa6e3e66b3251eb4bf5761d2f3f0f14095aaca, 62c85b9a0dd7471a362170323e1211ad98ff7b4b, 4c262801ea60c518b5bebc22a09f5b78b3147da2, 4c262801ea60c518b5bebc22a09f5b78b3147da2, 4c262801ea60c518b5bebc22a09f5b78b3147da2, 4c262801ea60c518b5bebc22a09f5b78b3147da2, 7abd221a55a61b6b2bf0e80f850bfc0ae75c7e01, 31a38a908c98aebc7a1104dab5f1ba199f234b7b, 04d748d4bd2d86739b159563f257e3dc5492c88d, 5.10.229, 5.15.170, 6.1.115, 6.6.59, 4.19.323, 5.4.285, 6.11.6unaffected
LinuxLinux6.12, 0, 5.10.241, 5.15.190, 6.1.149, 6.6.103, 6.12.43, 6.15.11, 6.16.2, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.