CVE-2025-38402: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38402 is a vulnerability in the Linux kernel's idpf network driver where returning -EOPNOTSUPP (an error code) from a function declared to return u32 results in an invalid, extremely large size value being used for memory allocation. This type confusion triggers allocation failures and kernel warnings when running ethtool -x on network interfaces that lack RSS (Receive Side Scaling) capabilities. The vulnerability was disclosed on July 25, 2025, and affects Linux kernel versions 6.7 through 6.12.37 and 6.13 through 6.15.6, as well as 6.16 release candidates rc1–rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a type confusion issue (CWE-476, NULL Pointer Dereference) in the idpf driver's RSS key size reporting function: when a device does not support RSS, the function incorrectly returns -EOPNOTSUPP (a negative integer error code) instead of 0, but since the function's return type is u32 (unsigned 32-bit integer), the negative value is cast to a very large positive number. This enormous value is then passed to kmalloc via rss_prepare_get(), causing a kernel warning and allocation failure. The attack vector is local, requiring low privileges — any user able to invoke ethtool -x <interface> on an affected device can trigger the bug. The kernel call trace shows the fault path through rss_prepare_get.constprop.0 → ethnl_default_doit → genl_rcv_msg (Red Hat Bugzilla).

Successful exploitation causes a kernel warning and memory allocation failure, resulting in a denial of service condition — specifically, system instability or a kernel crash — on the affected host. There is no confidentiality or integrity impact; the vulnerability is limited to availability (high). The issue affects any Linux system running a vulnerable kernel version with an idpf-driven network interface that lacks RSS capabilities (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.017% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access with low privileges and the presence of an idpf-managed network interface without RSS support (Red Hat Advisory).

The fix has been applied to the Linux kernel stable trees; patched versions include kernel 6.12.37 and 6.15.6 (and later). Patches are available from kernel.org stable branches and from Red Hat (git.kernel.org patch 1, git.kernel.org patch 2, git.kernel.org patch 3). Ubuntu has issued security notices USN-7833-1 through USN-7833-4, and SUSE has released advisory SUSE-2025-03633-1. As a workaround, avoid running ethtool -x on network interfaces managed by the idpf driver that do not have RSS capabilities, and restrict low-privilege user access to network configuration tools where possible (Red Hat Bugzilla).