CVE-2025-38375

A flaw was found in the Linux kernel's virtio-net component. This vulnerability, specifically an out-of-bounds read in the xdp_linearize_page function, occurs due to missing checks on the received buffer length. A malicious or compromised host/hypervisor can exploit this by providing an invalid buffer length. This can lead to sensitive memory disclosure or a denial of service (DoS) within the guest kernel.

This vulnerability arises from missing bounds checks in xdp_linearize_page(), which can lead to an out-of-bounds read if the virtio-backend provides an invalid buffer length. The issue can be triggered by a malicious or compromised host/hypervisor that controls the virtqueue, resulting in memory disclosure or denial-of-service within the guest kernel.

The CVSS vector uses AV:A (Adjacent Network) rather than AV:N, because the attack requires control of the local virtio communication channel between host and guest rather than being launched over an arbitrary external network. This reflects that the threat originates from an adjacent execution environment (e.g., host, co-tenant, or hypervisor component) rather than a remote Internet attacker.

The issue is rated PR:H because only privileged control of the virtio-net device (e.g., by the hypervisor or a privileged host process) can supply crafted buffers to reach the flawed code path, making it inaccessible to unprivileged guest users or remote attackers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module virtio_net from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.