---
id: CVE-2025-38375
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  virtio-net: ensure the received length does not exceed allocated size

  In xdp_linearize_page, when reading the following buffers from the ring,
  we forget to check the r…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  virtio-net: ensure the received length does not exceed allocated size

  In xdp_linearize_page, when reading the following buffers from the ring,
  we forget to check the r…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-125
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.14, < 5.4.297'
  - 'linux_kernel >= 5.5, < 5.10.241'
  - 'linux_kernel >= 5.11, < 5.15.189'
  - 'linux_kernel >= 5.16, < 6.1.144'
  - 'linux_kernel >= 6.2, < 6.6.97'
  - 'linux_kernel >= 6.7, < 6.12.37'
  - 'linux_kernel >= 6.13, < 6.15.6'
  - linux_kernel = 6.16
  - debian_linux = 11.0
patched:
  - linux_kernel 6.15.6
published: '2025-07-25'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:39.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38375'
references:
  - url: 'https://git.kernel.org/stable/c/11f2d0e8be2b5e784ac45fa3da226492c3e506d8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/315dbdd7cdf6aa533829774caaf4d25f1fd20e73'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6aca3dad2145e864dfe4d1060f45eb1bac75dd58'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/773e95c268b5d859f51f7547559734fd2a57660c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/80b971be4c37a4d23a7f1abc5ff33dc7733d649b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/982beb7582c193544eb9c6083937ec5ac1c9d651'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bc68bc3563344ccdc57d1961457cdeecab8f81ef'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ddc8649d363141fb3371dd81a73e1cb4ef8ed1e1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.0021
epssPercentile: 0.11125
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:49:50.702440Z'
ingestedAt: '2026-10-15T22:48:25.504Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

virtio-net: ensure the received length does not exceed allocated size

In xdp_linearize_page, when reading the following buffers from the ring,
we forget to check the received length with the true allocate size. This
can lead to an out-of-bound read. This commit adds that missing check.

## Affected

- `linux_kernel >= 4.14, < 5.4.297`
- `linux_kernel >= 5.5, < 5.10.241`
- `linux_kernel >= 5.11, < 5.15.189`
- `linux_kernel >= 5.16, < 6.1.144`
- `linux_kernel >= 6.2, < 6.6.97`
- `linux_kernel >= 6.7, < 6.12.37`
- `linux_kernel >= 6.13, < 6.15.6`
- `linux_kernel = 6.16`
- `debian_linux = 11.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.15.6`