CVE-2025-38413
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38413
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38413.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-38413
- Downstream
- Published
- 2025-07-25T13:20:17.394Z
- Modified
- 2025-11-16T21:16:34.529319Z
- Summary
- virtio-net: xsk: rx: fix the frame's length check
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
virtio-net: xsk: rx: fix the frame's length check
When calling buftoxdp, the len argument is the frame data's length without virtio header's length (vi->hdr_len). We check that len with
xsk_pool_get_rx_frame_size() + vi->hdr_lento ensure the provided len does not larger than the allocated chunk size. The additional vi->hdrlen is because in virtnetaddrecvbufxsk, we use part of XDPPACKETHEADROOM for virtio header and ask the vhost to start placing data from
hard_start + XDP_PACKET_HEADROOM - vi->hdr_lennot hardstart + XDPPACKET_HEADROOM
But the first buffer has virtio_header, so the maximum frame's length in the first buffer can only be
xsk_pool_get_rx_frame_size()not xskpoolgetrxframesize() + vi->hdrlen
like in the current check.
This commit adds an additional argument to buftoxdp differentiate between the first buffer and other ones to correctly calculate the maximum frame's length.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduceda4e7ba7027012f009f22a68bcfde670f9298d3a4Fixed892f6ed9a4a38bb3360fdff091b9241cfa105b61
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduceda4e7ba7027012f009f22a68bcfde670f9298d3a4Fixed6013bb6bc24c2cac3f45b37a15b71b232a5b00ff
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduceda4e7ba7027012f009f22a68bcfde670f9298d3a4Fixed5177373c31318c3c6a190383bfd232e6cf565c36