CVE-2025-38622: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38622 is a kernel panic (denial of service) vulnerability in the Linux kernel's UDP receive path, specifically in the udp_rcv_segment() function. It is triggered when a packet with a crafted virtio_net_hdr is sent to a TUN device with gso_type set to SKB_GSO_UDP and a gso_size smaller than the UDP header size, causing an invalid memory access in skb_pull_rcsum(). The vulnerability was published on August 22, 2025, and affects multiple Linux kernel stable branches from 5.0 through 6.16. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE).

The root cause is insufficient validation of UFO (UDP Fragmentation Offload) packets in udp_rcv_segment() before segmentation is attempted (CWE-20: Improper Input Validation). When a local user with access to a TUN device sends a packet with virtio_net_hdr specifying SKB_GSO_UDP and a gso_size less than the size of a UDP header, the kernel proceeds to call skb_pull_rcsum() with an invalid length, triggering a kernel BUG at net/core/skbuff.c:4572. The fix drops UFO packets in udp_rcv_segment() before they can reach the problematic code path. Exploitation requires local access and low privileges — specifically, the ability to write to a TUN device (Red Hat CVE, Kernel Patches).

Successful exploitation causes a kernel BUG/OOPS condition that crashes or hangs the affected system, resulting in a complete denial of service for all users and workloads on that host. There is no confidentiality or integrity impact — the vulnerability is limited to availability. In virtualized or multi-tenant environments where TUN device access is granted to unprivileged users, a single low-privileged local attacker could bring down the entire host (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of this report (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and the ability to interact with a TUN device, limiting the practical attack surface.

1. Gain local access: Obtain a low-privileged local account on a system running a vulnerable Linux kernel version (5.0–5.4.x before 5.4.297, 5.5–5.10.x before 5.10.241, 5.11–5.15.x before 5.15.190, 5.16–6.1.x before 6.1.148, 6.2–6.6.x before 6.6.102, 6.7–6.12.x before 6.12.42, 6.13–6.15.x before 6.15.10, or 6.16.x before 6.16.1).
2. Access a TUN device: Ensure the account has write access to a TUN device (e.g., /dev/net/tun), which may be available in environments running VPNs, containers, or virtual machines.
3. Craft a malicious virtio_net_hdr packet: Construct a packet with a virtio_net_hdr header where gso_type is set to VIRTIO_NET_HDR_GSO_UDP (corresponding to SKB_GSO_UDP) and gso_size is set to a value smaller than the UDP header size (8 bytes).
4. Send the packet to the TUN device: Write the crafted packet to the TUN device file descriptor, causing the kernel to process it through udp_rcv_segment().
5. Trigger kernel panic: The kernel calls skb_pull_rcsum() with an invalid length, hitting a BUG() assertion at net/core/skbuff.c:4572, crashing the system (Red Hat CVE).

• Logs: Kernel crash messages in /var/log/kern.log or dmesg output containing kernel BUG at net/core/skbuff.c:4572, Oops: invalid opcode, or call traces referencing skb_pull_rcsum and udp_rcv_segment.
• System Behavior: Unexpected system reboots or kernel panics, particularly on systems with TUN devices active (e.g., VPN servers, container hosts, QEMU/KVM hypervisors).
• Process: Unusual processes writing to /dev/net/tun from low-privileged user accounts, especially processes sending crafted UDP packets with abnormal GSO parameters.

Apply kernel updates to the following patched versions: 5.4.297+, 5.10.241+, 5.15.190+, 6.1.148+, 6.6.102+, 6.12.42+, 6.15.10+, or 6.16.1+. Patches are available via the stable kernel tree at git.kernel.org (Kernel Patches). Distribution-specific updates have been released by Red Hat, Ubuntu (USN-7909-1, USN-7910-1, USN-7933-1, USN-7938-1), Oracle Linux, Amazon Linux 2, and others (Red Hat CVE, Ubuntu USN-7909). Until patching is complete, restrict local user access to TUN devices, limit privileges for network device creation, and consider disabling UDP offloading features if operationally feasible.