CVE-2025-38375: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-38375 Overview

CVE-2025-38375 is an out-of-bounds read vulnerability in the Linux kernel's virtio-net driver. The flaw resides in the xdp_linearize_page function, which fails to validate that the received buffer length does not exceed the allocated page size when reading subsequent buffers from the ring. A local, authenticated attacker in a virtualized guest environment can trigger the condition to read beyond allocated memory. The issue is classified under [CWE-125] (Out-of-Bounds Read) and affects multiple stable Linux kernel branches, including release candidates of 6.16 and Debian Linux 11.0.

Critical Impact
A local attacker with low privileges can trigger an out-of-bounds read in the virtio-net driver, potentially exposing kernel memory contents or destabilizing the host.

Affected Products

Linux Kernel (multiple stable branches, including 6.16-rc1 through 6.16-rc4)
Debian Linux 11.0
Systems using the virtio-net driver with XDP enabled

Discovery Timeline

2025-07-25 - CVE-2025-38375 published to NVD
2025-10-07 - Debian LTS advisory published (Debian LTS Advisory)
2025-10-08 - Second Debian LTS advisory published (Debian LTS Advisory)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38375

Vulnerability Analysis

The vulnerability resides in the virtio-net network driver, specifically within the xdp_linearize_page function. This function linearizes packet data across multiple ring buffers so eXpress Data Path (XDP) programs can process contiguous memory. When iterating over follow-up buffers pulled from the virtqueue, the code trusts the length reported by the device without confirming it fits within the destination page's allocated size.

Because XDP-related buffers are typically page-sized, an attacker-controlled or malformed length value causes the copy loop to read past the end of the allocated page. The result is an out-of-bounds read of adjacent kernel memory. Consequences include kernel information disclosure, corruption-adjacent side effects, and potential integrity or availability impacts, matching the CIA impact profile assigned to this issue.

Root Cause

The root cause is a missing length validation. In xdp_linearize_page, the code path that reads subsequent buffers from the ring omits a check comparing the received len value against the true allocated buffer size (PAGE_SIZE minus offset). The upstream fix adds that missing bounds check, rejecting or truncating buffers that exceed the allocation.

Attack Vector

Exploitation requires local access to the guest and the ability to interact with the virtio-net interface, typically through crafted network activity that produces packets with unexpected fragment lengths. XDP must be attached to the interface for the vulnerable code path to execute. Successful exploitation triggers an out-of-bounds read whose contents may leak to userspace, downstream network flows, or influence subsequent kernel decisions.

Because the vulnerability lives in a paravirtualized driver, the primary risk profile is compromised or malicious guests targeting host memory boundaries, or malicious peers on a shared virtual network attempting to influence guest kernel state through crafted packets.

No public proof-of-concept exploit is available at this time. See the upstream fix commits, including Kernel Commit 11f2d0e8 and Kernel Commit 773e95c2, for the corrective patch adding the length check.

Detection Methods for CVE-2025-38375

Indicators of Compromise

Unexpected kernel warnings or KASAN reports referencing xdp_linearize_page or virtnet_xdp code paths.
Guest kernel panics or crashes on hosts running virtio-net with XDP programs attached.
Anomalous virtqueue length values recorded in kernel tracing (ftrace, bpftrace) around the virtio-net receive path.

Detection Strategies

Inventory Linux kernel versions across virtualized workloads and match against the fixed commits published on git.kernel.org.
Use kernel telemetry and eBPF-based tracing to observe abnormal receive-buffer lengths on virtio-net interfaces where XDP is attached.
Correlate host and guest crash telemetry to identify repeated faults originating from the virtio_net module.

Monitoring Recommendations

Aggregate kernel logs (dmesg, journalctl) from virtualized fleets into a central data lake and alert on virtio_net stack traces.
Monitor for the presence and modification of XDP programs on guest network interfaces using ip link audit records.
Track patch compliance for Debian 11 systems against the LTS advisories published on 2025-10-07 and 2025-10-08.

How to Mitigate CVE-2025-38375

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits, or the distribution-provided updates, on all affected hosts and guests.
For Debian 11 systems, install the kernel updates announced in the Debian LTS Advisory 2025-10-07 and Debian LTS Advisory 2025-10-08.
Reboot affected systems after patching to ensure the fixed kernel is active.
Restrict local access to virtualized workloads until patches are rolled out.

Patch Information

The fix is available in the upstream stable trees via commits 11f2d0e8, 315dbdd7, 6aca3dad, 773e95c2, 80b971be, 982beb75, bc68bc35, and ddc8649d. Each commit adds the missing length validation in xdp_linearize_page so that received buffer lengths are checked against the true allocated size before being consumed. Distribution packages incorporating these commits, including Debian LTS updates for Debian 11, should be deployed across affected fleets.

Workarounds

Detach XDP programs from virtio-net interfaces where XDP is not required, since the vulnerable code path only executes when XDP is attached.
Limit which workloads and tenants can attach XDP programs by restricting CAP_NET_ADMIN and CAP_BPF capabilities.
Where feasible, disable the affected feature flags on virtual NICs at the hypervisor level until kernels are patched.

bash

# Check running kernel version and virtio-net XDP status
uname -r
ip -details link show | grep -E 'virtio|xdp'

# On Debian 11, apply the LTS kernel update
sudo apt update
sudo apt install --only-upgrade linux-image-amd64
sudo reboot