CVE-2025-38570 (GCVE-0-2025-38570)
Vulnerability from cvelistv5
Published
2025-08-19 17:02
Modified
2026-08-05 12:02
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: unlink NAPIs from queues on error to open CI hit a UaF in fbnic in the AF_XDP portion of the queues.py test. The UaF is in the __sk_mark_napi_id_once() call in xsk_bind(), NAPI has been freed. Looks like the device failed to open earlier, and we lack clearing the NAPI pointer from the queue.
References
Impacted products
Vendor Product Version
Linux Linux Version: 557d02238e05eb66b9aba9a1f90f3a2131c6c887
Version: 557d02238e05eb66b9aba9a1f90f3a2131c6c887
Version: 557d02238e05eb66b9aba9a1f90f3a2131c6c887
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/meta/fbnic/fbnic_netdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21d3f8441c7f317b93ba6a8029610c8b7e3773db",
              "status": "affected",
              "version": "557d02238e05eb66b9aba9a1f90f3a2131c6c887",
              "versionType": "git"
            },
            {
              "lessThan": "4b59f9deff3bdb52b223c85048f1d2924803b817",
              "status": "affected",
              "version": "557d02238e05eb66b9aba9a1f90f3a2131c6c887",
              "versionType": "git"
            },
            {
              "lessThan": "4b31bcb025cb497da2b01f87173108ff32d350d2",
              "status": "affected",
              "version": "557d02238e05eb66b9aba9a1f90f3a2131c6c887",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/meta/fbnic/fbnic_netdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: unlink NAPIs from queues on error to open\n\nCI hit a UaF in fbnic in the AF_XDP portion of the queues.py test.\nThe UaF is in the __sk_mark_napi_id_once() call in xsk_bind(),\nNAPI has been freed. Looks like the device failed to open earlier,\nand we lack clearing the NAPI pointer from the queue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The dangling NAPI pointer is created by a local netdev administrative operation (link up) and dereferenced through local syscalls \u2014 `bind()` on an AF_XDP socket or a netdev-genl queue query. No remote peer data reaches this code path.\nAC:L - Once the failed open leaves the pointers dangling, the UAF is a persistent state rather than a race window, and `xsk_bind()` with `XDP_COPY` reaches `rxq-\u003enapi-\u003enapi_id` deterministically on the down device for every queue index, repeatable at will. The open failure itself is attacker-influenceable (`-ENOMEM` in `fbnic_tlv_msg_alloc()`/`request_irq()` under attacker-generated memory pressure, or an unready FW mailbox) and link-up can be retried indefinitely.\nPR:L - Both required capabilities are namespaced \u2014 `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)` for RTM_SETLINK link-up and `ns_capable(net-\u003euser_ns, CAP_NET_RAW)` for AF_XDP socket creation \u2014 so an unprivileged user in a user-namespace-owned netns with the NIC delegated (container/passthrough deployments) can perform the whole sequence without real root.\nUI:N - The attacker performs both the link-up that fails and the subsequent AF_XDP bind; no action by any other user or victim process is needed.\nS:U - The freed object and the corrupted pointers both live in kernel memory under the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free read of a freed `fbnic_napi_vector` slab object, and the attacker can spray the freed allocation before triggering the read; the value is then exfiltrated to userspace via `getsockopt(SO_INCOMING_NAPI_ID)`, giving a repeatable read primitive over reclaimed kernel heap.\nI:H - Stale `struct napi_struct *` pointers persist in the netdev\u0027s rx and tx queue structures after the backing allocation is freed; per UAF treatment this heap-reuse condition is exploitable for controlling reclaimed object contents and hijacking dependent state.\nA:H - Dereferencing the freed vector \u2014 potentially after the slab page has been returned to the page allocator \u2014 produces an oops or panic, and the condition can be re-triggered against every queue index on the affected interface."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:58.557Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21d3f8441c7f317b93ba6a8029610c8b7e3773db"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b59f9deff3bdb52b223c85048f1d2924803b817"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b31bcb025cb497da2b01f87173108ff32d350d2"
        }
      ],
      "title": "eth: fbnic: unlink NAPIs from queues on error to open",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38570",
    "datePublished": "2025-08-19T17:02:50.677Z",
    "dateReserved": "2025-04-16T04:51:24.025Z",
    "dateUpdated": "2026-08-05T12:02:58.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.