Executive brief
A vulnerability in the Linux kernel's Wangxun network driver (libwx) could allow a local user to cause a system crash or potentially compromise system integrity. The issue occurs when the network device is reset, such as when changing network settings like VLAN offloading, because the system fails to properly clear old data from the network hardware's memory. This can lead to the creation of corrupted data packets that trigger a kernel panic (system crash).
Technical details
A vulnerability exists in the Linux kernel 'libwx' driver (used by Wangxun Ethernet devices) due to missing initialization of the Rx ring descriptor during a device reset. When a reset is triggered (e.g., via wx->do_reset() during VLAN offload toggling), the hardware descriptor ring may retain stale values. Because the driver previously only zeroed the length of the first descriptor (rx_desc[0]), the kernel could attempt to build malformed socket buffers (SKBs), resulting in a 'kernel BUG' at net/core/skbuff.c:2814. An attacker with local privileges to trigger network configuration changes could exploit this to cause a Denial of Service (DoS) or potentially achieve further impact. The fix ensures that 'next_to_clean' and 'next_to_use' indices are properly reset to synchronize software with hardware.
Affected products
- Linux Linux Kernel 3c47e8ae113a to d510116c80b3, 10e27b2a6ebe, d992ed7e1b68, ee527d3fba4d
Timeline
- 2025-07-14: patched: Initial patch authored by Jiawen Wu
- 2025-08-16: advisory: CVE-2025-38532 published in NVD