NetSight
IP …
high8.4

CVE-2025-38375

In the Linux kernel, the following vulnerability has been resolved: virtio-net: ensure the received length does not exceed allocated size In xdp_linearize_page…

Impact

In the Linux kernel, the following vulnerability has been resolved: virtio-net: ensure the received length does not exceed allocated size In xdp_linearize_page, when reading the following buffers from the ring, we forget to check the received length with the true allocate size. This can lead to an out-of-bound read. This commit adds that missing check.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.14 before 5.4.297
from 5.5 before 5.10.241
from 5.11 before 5.15.189
from 5.16 before 6.1.144
from 6.2 before 6.6.97
from 6.7 before 6.12.37
DebianDebian Linux
Version 11.0

Weakness classification

CWE-125

References