CVE-2025-37799 (GCVE-0-2025-37799)
Vulnerability from cvelistv5
Published
2025-05-03 11:39
Modified
2026-08-05 11:57
Severity ?
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Summary
In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp vmxnet3 driver's XDP handling is buggy for packet sizes using ring0 (that is, packet sizes between 128 - 3k bytes). We noticed MTU-related connectivity issues with Cilium's service load- balancing in case of vmxnet3 as NIC underneath. A simple curl to a HTTP backend service where the XDP LB was doing IPIP encap led to overly large packet sizes but only for *some* of the packets (e.g. HTTP GET request) while others (e.g. the prior TCP 3WHS) looked completely fine on the wire. In fact, the pcap recording on the backend node actually revealed that the node with the XDP LB was leaking uninitialized kernel data onto the wire for the affected packets, for example, while the packets should have been 152 bytes their actual size was 1482 bytes, so the remainder after 152 bytes was padded with whatever other data was in that page at the time (e.g. we saw user/payload data from prior processed packets). We only noticed this through an MTU issue, e.g. when the XDP LB node and the backend node both had the same MTU (e.g. 1500) then the curl request got dropped on the backend node's NIC given the packet was too large even though the IPIP-encapped packet normally would never even come close to the MTU limit. Lowering the MTU on the XDP LB (e.g. 1480) allowed to let the curl request succeed (which also indicates that the kernel ignored the padding, and thus the issue wasn't very user-visible). Commit e127ce7699c1 ("vmxnet3: Fix missing reserved tailroom") was too eager to also switch xdp_prepare_buff() from rcd->len to rbi->len. It really needs to stick to rcd->len which is the actual packet length from the descriptor. The latter we also feed into vmxnet3_process_xdp_small(), by the way, and it indicates the correct length needed to initialize the xdp->{data,data_end} parts. For e127ce7699c1 ("vmxnet3: Fix missing reserved tailroom") the relevant part was adapting xdp_init_buff() to address the warning given the xdp_data_hard_end() depends on xdp->frame_sz. With that fixed, traffic on the wire looks good again.
References
Impacted products
Vendor Product Version
Linux Linux Version: aba8659caf88017507419feea06069f529329ea6
Version: e127ce7699c1e05279ee5ee61f00893e7bfa9671
Version: e127ce7699c1e05279ee5ee61f00893e7bfa9671
Version: e127ce7699c1e05279ee5ee61f00893e7bfa9671
Version: 7c8505ecc2d15473d679b8e06335434b84fffe86
Version: 91d017d19d5a9ad153e2dc23ed3c0e2e79ef5262
Version: 6.6.23   ≤
Version: 6.7.11   ≤
Version: 6.8.2   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vmxnet3/vmxnet3_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c4312c4d244aa58e811ff0297e013124d115e793",
              "status": "affected",
              "version": "aba8659caf88017507419feea06069f529329ea6",
              "versionType": "git"
            },
            {
              "lessThan": "33e131a10459d16f181c8184d3f17f1c318c7002",
              "status": "affected",
              "version": "e127ce7699c1e05279ee5ee61f00893e7bfa9671",
              "versionType": "git"
            },
            {
              "lessThan": "e3ad76e36a37b0ff4a71b06d5b33530ee8c3a177",
              "status": "affected",
              "version": "e127ce7699c1e05279ee5ee61f00893e7bfa9671",
              "versionType": "git"
            },
            {
              "lessThan": "4c2227656d9003f4d77afc76f34dd81b95e4c2c4",
              "status": "affected",
              "version": "e127ce7699c1e05279ee5ee61f00893e7bfa9671",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7c8505ecc2d15473d679b8e06335434b84fffe86",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "91d017d19d5a9ad153e2dc23ed3c0e2e79ef5262",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.89",
              "status": "affected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vmxnet3/vmxnet3_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.89",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.89",
                  "versionStartIncluding": "6.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.26",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.5",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp\n\nvmxnet3 driver\u0027s XDP handling is buggy for packet sizes using ring0 (that\nis, packet sizes between 128 - 3k bytes).\n\nWe noticed MTU-related connectivity issues with Cilium\u0027s service load-\nbalancing in case of vmxnet3 as NIC underneath. A simple curl to a HTTP\nbackend service where the XDP LB was doing IPIP encap led to overly large\npacket sizes but only for *some* of the packets (e.g. HTTP GET request)\nwhile others (e.g. the prior TCP 3WHS) looked completely fine on the wire.\n\nIn fact, the pcap recording on the backend node actually revealed that the\nnode with the XDP LB was leaking uninitialized kernel data onto the wire\nfor the affected packets, for example, while the packets should have been\n152 bytes their actual size was 1482 bytes, so the remainder after 152 bytes\nwas padded with whatever other data was in that page at the time (e.g. we\nsaw user/payload data from prior processed packets).\n\nWe only noticed this through an MTU issue, e.g. when the XDP LB node and\nthe backend node both had the same MTU (e.g. 1500) then the curl request\ngot dropped on the backend node\u0027s NIC given the packet was too large even\nthough the IPIP-encapped packet normally would never even come close to\nthe MTU limit. Lowering the MTU on the XDP LB (e.g. 1480) allowed to let\nthe curl request succeed (which also indicates that the kernel ignored the\npadding, and thus the issue wasn\u0027t very user-visible).\n\nCommit e127ce7699c1 (\"vmxnet3: Fix missing reserved tailroom\") was too eager\nto also switch xdp_prepare_buff() from rcd-\u003elen to rbi-\u003elen. It really needs\nto stick to rcd-\u003elen which is the actual packet length from the descriptor.\nThe latter we also feed into vmxnet3_process_xdp_small(), by the way, and\nit indicates the correct length needed to initialize the xdp-\u003e{data,data_end}\nparts. For e127ce7699c1 (\"vmxnet3: Fix missing reserved tailroom\") the\nrelevant part was adapting xdp_init_buff() to address the warning given the\nxdp_data_hard_end() depends on xdp-\u003eframe_sz. With that fixed, traffic on\nthe wire looks good again."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code runs in the vmxnet3 RX path (`vmxnet3_rq_rx_complete` \u2192 `vmxnet3_process_xdp`) directly on frames received from the network, and the trigger condition is simply a packet whose length falls in the 128\u20133 K ring0 band, which a remote sender fully controls. The leaked kernel memory is then re-emitted on the wire via XDP_TX/XDP_REDIRECT or forwarded/bridged frames, so both the trigger and the disclosure channel are remote.\nAC:L - The attacker only needs to send ordinary packets of a chosen size; every such packet deterministically produces an over-long buffer, with no race, no memory-layout dependency, and no state the attacker cannot influence. XDP-on-vmxnet3 is a common deployed configuration (Cilium XDP load-balancing on VMware guests, the exact scenario reported), not a rare build-time option.\nPR:N - No credentials, session, or local account are needed \u2014 an unauthenticated remote host simply sends packets to the interface. The bug is hit in NAPI softirq context before any protocol-level authentication.\nUI:N - Processing occurs automatically in the driver\u0027s NAPI receive path with no victim action required. No local user must open, mount, or configure anything at exploitation time.\nS:U - The disclosed memory and the corrupted packets belong to the same kernel/host security authority as the vulnerable driver. There is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Up to ~3 KB of uninitialized kernel page memory per packet is exposed to the XDP program, to the local skb consumers, and \u2014 as confirmed by the reporter\u0027s pcap on the peer node \u2014 transmitted onto the wire, containing prior packets\u0027 user payloads and arbitrary stale page contents. The leak is attacker-triggerable at line rate, giving a sustained remote kernel-memory read channel.\nI:L - The kernel emits and delivers malformed packets whose length is inflated with unintended trailing data, corrupting frames as seen by remote peers, bridged/forwarded receivers, and raw-socket consumers. The modification is real but bounded and its content is not attacker-chosen.\nA:L - The oversized frames caused documented connectivity failures \u2014 legitimate requests dropped at the receiving NIC for exceeding MTU after encapsulation \u2014 degrading the network service. There is no kernel crash, hang, or out-of-bounds access, so the impact stays at degradation rather than full loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:57:38.193Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c4312c4d244aa58e811ff0297e013124d115e793"
        },
        {
          "url": "https://git.kernel.org/stable/c/33e131a10459d16f181c8184d3f17f1c318c7002"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3ad76e36a37b0ff4a71b06d5b33530ee8c3a177"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c2227656d9003f4d77afc76f34dd81b95e4c2c4"
        }
      ],
      "title": "vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37799",
    "datePublished": "2025-05-03T11:39:51.924Z",
    "dateReserved": "2025-04-16T04:51:23.941Z",
    "dateUpdated": "2026-08-05T11:57:38.193Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.