Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash or memory leak. The issue occurs when specific network interface settings (VLAN filtering) are changed while the system is running. This can lead to operational instability or a complete denial of service for the affected server.
Technical details
A vulnerability exists in the Linux kernel's net/8021q module due to a refcount imbalance for VLAN 0. When the 'rx-vlan-filter' feature is toggled during runtime, the kernel may fail to properly track whether VLAN 0 was automatically added or removed during administrative state changes (UP/DOWN). This leads to two scenarios: a memory leak if the filter is disabled while the device is running, or a null-pointer dereference/BUG_ON crash if the filter is re-enabled and the device is subsequently brought down. The fix involves tracking the 'auto_vid0' state within the VLAN info structure to ensure consistent cleanup regardless of the current filtering feature state.
Affected products
- Linux Linux Kernel 6.16-rc1 to 6.16-rc3
Timeline
- 2025-07-16: patched: Initial patch submitted by Huawei engineers
- 2025-07-28: advisory: CVE-2025-38470 published
References
- https://git.kernel.org/stable/c/047b61a24d7c866c502aeeea482892969a68f216
- https://git.kernel.org/stable/c/35142b3816832889e50164d993018ea5810955ae
- https://git.kernel.org/stable/c/579d4f9ca9a9a605184a9b162355f6ba131f678d
- https://git.kernel.org/stable/c/8984bcbd1edf5bee5be06ad771d157333b790c33
- https://git.kernel.org/stable/c/93715aa2d80e6c5cea1bb486321fc4585076928b
- https://git.kernel.org/stable/c/ba48d3993af23753e1f1f01c8d592de9c7785f24
- https://git.kernel.org/stable/c/bb515c41306454937464da055609b5fb0a27821b