CVE-2025-38385: Linux Kernel NAPI Deletion Vulnerability

CVE-2025-38385 Overview

CVE-2025-38385 is a Linux kernel vulnerability in the lan78xx USB Ethernet driver. The flaw resides in the driver disconnect path where a redundant call to netif_napi_del() triggers a WARN in __netif_napi_del_locked() at net/core/dev.c:7417. The warning fires because NAPI is still enabled when the disconnect handler attempts to delete the NAPI instance. The condition is triggered during USB device disconnect events on systems using the Microchip LAN78xx family of USB-to-Ethernet adapters.

Critical Impact
Local attackers with physical or logical control over USB devices can trigger kernel warnings and potentially destabilize kernel state during device disconnect, leading to denial of service on affected Linux systems.

Affected Products

Linux Kernel 6.16-rc1 through 6.16-rc4
Linux Kernel stable branches prior to the fix commits
Debian Linux 11.0 (LTS)

Discovery Timeline

2025-07-25 - CVE CVE-2025-38385 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38385

Vulnerability Analysis

The vulnerability is classified under [CWE-404] (Improper Resource Shutdown or Release). It affects the lan78xx_disconnect() function in drivers/net/usb/lan78xx.c, the driver for Microchip LAN78xx USB Gigabit Ethernet controllers.

When a LAN78xx USB device is physically removed or logically disconnected, the driver's disconnect handler executes cleanup routines. The handler calls netif_napi_del() explicitly while NAPI polling remains enabled. This violates the kernel's NAPI lifecycle contract enforced in __netif_napi_del_locked(), which requires NAPI to be disabled before deletion.

The result is a kernel WARN splat, followed by potentially inconsistent network stack state. Subsequent register reads fail with -ENODEV, and the driver logs errors such as Failed to read register index 0x000000c4 and failed to kill vid 0081/0.

Root Cause

The root cause is a redundant teardown sequence. The unregister_netdev() call already handles NAPI teardown automatically and safely as part of standard netdev unregistration. The explicit netif_napi_del() invocation in the disconnect path duplicates this work and executes it while NAPI remains active. Removing the redundant call eliminates the warning and aligns the driver with kernel networking teardown conventions.

Attack Vector

Exploitation requires local access. An attacker with the ability to attach and disconnect a LAN78xx USB device, or to trigger USB hub events via usb_hub_wq, can reproduce the condition reliably. The vulnerability manifests during driver unbind operations processed by usb_unbind_interface() and propagated through device_release_driver_internal(). See the upstream kernel commit for the exact code path.

No synthetic exploit code is published; the fault reproduces naturally on any system with the vulnerable driver when the device is disconnected.

Detection Methods for CVE-2025-38385

Indicators of Compromise

Kernel log entries containing WARNING: CPU: X PID: Y at net/core/dev.c:7417 __netif_napi_del_locked+0x2b4/0x350
lan78xx driver messages reporting Failed to read register index with return code -ENODEV
Driver warnings such as Failed to set MAC down with error -ENODEV and failed to kill vid after USB disconnect events
Call traces referencing lan78xx_disconnect+0xf4/0x360 followed by usb_unbind_interface

Detection Strategies

Monitor dmesg and /var/log/kern.log for the specific WARN signature tied to __netif_napi_del_locked
Correlate USB hub events (hub_event in usb_hub_wq) with subsequent NAPI teardown warnings
Inventory running kernel versions against affected 6.16-rc1 through 6.16-rc4 releases and unpatched stable branches

Monitoring Recommendations

Forward kernel ring buffer logs to a centralized SIEM and alert on net/core/dev.c WARN traces
Track kernel version drift across Linux fleet endpoints to identify systems still exposed to the flaw
Audit USB device attach and detach events on systems using LAN78xx-based adapters

How to Mitigate CVE-2025-38385

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org stable commits as soon as vendor packages are available
Update Debian 11 systems per the Debian LTS Announcement
Restrict physical and logical USB device attachment on production systems where LAN78xx adapters are not required

Patch Information

The fix removes the redundant netif_napi_del() call from lan78xx_disconnect(). Backport commits are available across multiple stable branches: 17a37b9a, 510a6095, 6c7ffc9a, 7135056a, and 968a419c.

Workarounds

Blacklist the lan78xx kernel module on systems that do not require LAN78xx USB Ethernet adapters
Enforce USB device authorization policies via udev rules to block untrusted USB Ethernet devices
Avoid hot-unplugging LAN78xx devices on unpatched kernels; power down the system before disconnecting hardware

bash

# Blacklist the vulnerable driver until patches are applied
echo "blacklist lan78xx" | sudo tee /etc/modprobe.d/blacklist-lan78xx.conf
sudo update-initramfs -u

# Verify current kernel version against affected releases
uname -r