CVE-2025-38020: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38020 is a vulnerability discovered in the Linux kernel affecting the MACsec offload functionality for uplink representor profiles. The vulnerability was disclosed on June 18, 2025, and involves a feature mismatch in the switchdev mode for uplink representors (NVD Database, Wiz).

The vulnerability occurs when MACsec offload feature remains enabled for uplink representor profiles in switchdev mode, despite not being supported. When switching to the uplink representor profile, the MACsec offload feature bit remains set but isn't properly cleared from the netdevice's features. The fix involves clearing NETIFFHWMACSEC in mlx5efixuplinkrep_features() (NVD Database).

When exploited, this vulnerability leads to a null pointer dereference, which can cause system crashes and potential denial of service conditions. The issue manifests as a general protection fault with a non-canonical address, potentially affecting system stability and network operations (NVD Database).

The vulnerability has been resolved in various Linux distributions. Debian has released fixes in multiple versions: bullseye (5.10.237-1), bookworm (6.1.140-1), and trixie (6.12.31-1). The fix involves properly clearing the MACsec offload feature bit when switching to uplink representor profiles (Debian Security).