CVE-2025-38735 (GCVE-0-2025-38735)
Vulnerability from cvelistv5
Published
2025-09-05 17:20
Modified
2026-08-05 12:04
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: gve: prevent ethtool ops after shutdown A crash can occur if an ethtool operation is invoked after shutdown() is called. shutdown() is invoked during system shutdown to stop DMA operations without performing expensive deallocations. It is discouraged to unregister the netdev in this path, so the device may still be visible to userspace and kernel helpers. In gve, shutdown() tears down most internal data structures. If an ethtool operation is dispatched after shutdown(), it will dereference freed or NULL pointers, leading to a kernel panic. While graceful shutdown normally quiesces userspace before invoking the reboot syscall, forced shutdowns (as observed on GCP VMs) can still trigger this path. Fix by calling netif_device_detach() in shutdown(). This marks the device as detached so the ethtool ioctl handler will skip dispatching operations to the driver.
References
Impacted products
Vendor Product Version
Linux Linux Version: 974365e518617c9ce917f61aacbba07e4bedcca0
Version: 974365e518617c9ce917f61aacbba07e4bedcca0
Version: 974365e518617c9ce917f61aacbba07e4bedcca0
Version: 974365e518617c9ce917f61aacbba07e4bedcca0
Version: 974365e518617c9ce917f61aacbba07e4bedcca0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:42:05.176Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:06:01.502Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/google/gve/gve_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "48a4e89d50e8ea52e800bc7865970b92fcf4647c",
              "status": "affected",
              "version": "974365e518617c9ce917f61aacbba07e4bedcca0",
              "versionType": "git"
            },
            {
              "lessThan": "ba51d73408edf815cbaeab148625576c2dd90192",
              "status": "affected",
              "version": "974365e518617c9ce917f61aacbba07e4bedcca0",
              "versionType": "git"
            },
            {
              "lessThan": "a7efffeecb881b4649fdc30de020ef910f35d646",
              "status": "affected",
              "version": "974365e518617c9ce917f61aacbba07e4bedcca0",
              "versionType": "git"
            },
            {
              "lessThan": "9d8a41e9a4ff83ff666de811e7f012167cdc00e9",
              "status": "affected",
              "version": "974365e518617c9ce917f61aacbba07e4bedcca0",
              "versionType": "git"
            },
            {
              "lessThan": "75a9a46d67f46d608205888f9b34e315c1786345",
              "status": "affected",
              "version": "974365e518617c9ce917f61aacbba07e4bedcca0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/google/gve/gve_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: prevent ethtool ops after shutdown\n\nA crash can occur if an ethtool operation is invoked\nafter shutdown() is called.\n\nshutdown() is invoked during system shutdown to stop DMA operations\nwithout performing expensive deallocations. It is discouraged to\nunregister the netdev in this path, so the device may still be visible\nto userspace and kernel helpers.\n\nIn gve, shutdown() tears down most internal data structures. If an\nethtool operation is dispatched after shutdown(), it will dereference\nfreed or NULL pointers, leading to a kernel panic. While graceful\nshutdown normally quiesces userspace before invoking the reboot\nsyscall, forced shutdowns (as observed on GCP VMs) can still trigger\nthis path.\n\nFix by calling netif_device_detach() in shutdown().\nThis marks the device as detached so the ethtool ioctl handler\nwill skip dispatching operations to the driver."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable ethtool ops are reached only via the local `SIOCETHTOOL` ioctl on an AF_INET socket or the ethtool netlink family, both of which require local access to the system. No remote or adjacent packet path reaches `gve_ethtool_ops`.\nAC:L - This is not a narrow race \u2014 after `gve_shutdown()` returns, the driver stays in the torn-down state with dangling `priv-\u003eadminq`/`priv-\u003eadminq_pool` until power-off, so any ethtool ioctl issued in that window deterministically hits freed/NULL pointers with no memory grooming or race-winning required. The attacker simply polls `ethtool` in a loop and system shutdown/reboot is a routine, guaranteed event; userspace is not quiesced during `device_shutdown()`, giving a wide and reliably-hit window.\nPR:L - `net/ethtool/ioctl.c:3266-3305` explicitly exempts `ETHTOOL_GSET`, `ETHTOOL_GLINKSETTINGS`, `ETHTOOL_GSTATS`, `ETHTOOL_GRXCLSRLCNT`, `ETHTOOL_GRSSH` and friends from the `CAP_NET_ADMIN` check, and `SIOCETHTOOL` in `net/core/dev_ioctl.c` adds no gate \u2014 so an ordinary unprivileged user running `ethtool eth0` or `ethtool -S eth0` reaches `gve_get_link_ksettings()`, `gve_get_rxnfc()` and `gve_get_ethtool_stats()`.\nUI:N - The attacker issues the ioctl directly from their own process with no victim participation; the shutdown is an ambient system event, not an action the attacker must socially engineer a user into performing.\nS:U - The corruption and crash are confined to the kernel of the same system whose ethtool interface was invoked, with no crossing into a hypervisor, IOMMU or other security authority.\nC:H - `gve_adminq_kick_and_wait()` reads command status out of the freed `priv-\u003eadminq` DMA buffer and `gve_adminq_query_flow_rules()` dereferences the kfree\u0027d `struct dma_pool`, so contents of reallocated kernel memory are read back and influence returned data and control flow, giving a use-after-free read primitive over attacker-groomable heap.\nI:H - `gve_adminq_issue_cmd()` performs a 64-byte `memcpy()` into the freed `priv-\u003eadminq` allocation, and `dma_pool_alloc()` on the destroyed pool manipulates freed list heads and a freed spinlock \u2014 a use-after-free write into recycled memory that can be sprayed with attacker-chosen objects and leveraged toward control-flow hijack.\nA:H - `gve_get_ethtool_stats()` dereferences the NULLed `priv-\u003estats_report` and `priv-\u003entfy_blocks`, producing the kernel panic described in the commit; because it fires mid-shutdown the machine hangs on the panic instead of completing its reboot, turning a routine restart into an unavailable host needing out-of-band recovery."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:25.933Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/48a4e89d50e8ea52e800bc7865970b92fcf4647c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba51d73408edf815cbaeab148625576c2dd90192"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7efffeecb881b4649fdc30de020ef910f35d646"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d8a41e9a4ff83ff666de811e7f012167cdc00e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/75a9a46d67f46d608205888f9b34e315c1786345"
        }
      ],
      "title": "gve: prevent ethtool ops after shutdown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38735",
    "datePublished": "2025-09-05T17:20:35.459Z",
    "dateReserved": "2025-04-16T04:51:24.034Z",
    "dateUpdated": "2026-08-05T12:04:25.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.