PT-2025-30813 · Linux+4 · Linux Kernel+4

Published 2025-06-30 · Updated 2025-11-25 · CVE-2025-38413

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the virtio-net xsk receive (rx) path related to frame length checking. The buf to xdp function incorrectly calculates the maximum frame length for the first buffer, potentially leading to issues when processing network packets. Specifically, the length check did not account for the virtio header when determining the maximum frame size for the initial buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2025-09127

CVE-2025-38413

OPENSUSE-SU-2025:20081-1

SUSE-SU-2025:21074-1

SUSE-SU-2025:21139-1

SUSE-SU-2025:21179-1

USN-7833-1

USN-7833-2

USN-7833-3

USN-7833-4

USN-7834-1

USN-7856-1

Affected Products

Astra Linux

Linuxmint

Linux Kernel

Suse

Ubuntu

References · 1463

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38413.json · Exploit
• https://ubuntu.com/security/CVE-2025-38405 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38236 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7834-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38401 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38230 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38251 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38258 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38374 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38388 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:20081-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38084 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38425 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38219 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38264 · Vendor Advisory