GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38470 (GCVE-0-2025-38470)

Vulnerability from cvelistv5 – Published: 2025-07-28 11:21 – Updated: 2026-08-05 12:02
VLAI
Title
net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
Summary
In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Assuming the "rx-vlan-filter" feature is enabled on a net device, the 8021q module will automatically add or remove VLAN 0 when the net device is put administratively up or down, respectively. There are a couple of problems with the above scheme. The first problem is a memory leak that can happen if the "rx-vlan-filter" feature is disabled while the device is running: # ip link add bond1 up type bond mode 0 # ethtool -K bond1 rx-vlan-filter off # ip link del dev bond1 When the device is put administratively down the "rx-vlan-filter" feature is disabled, so the 8021q module will not remove VLAN 0 and the memory will be leaked [1]. Another problem that can happen is that the kernel can automatically delete VLAN 0 when the device is put administratively down despite not adding it when the device was put administratively up since during that time the "rx-vlan-filter" feature was disabled. null-ptr-unref or bug_on[2] will be triggered by unregister_vlan_dev() for refcount imbalance if toggling filtering during runtime: $ ip link add bond0 type bond mode 0 $ ip link add link bond0 name vlan0 type vlan id 0 protocol 802.1q $ ethtool -K bond0 rx-vlan-filter off $ ifconfig bond0 up $ ethtool -K bond0 rx-vlan-filter on $ ifconfig bond0 down $ ip link del vlan0 Root cause is as below: step1: add vlan0 for real_dev, such as bond, team. register_vlan_dev vlan_vid_add(real_dev,htons(ETH_P_8021Q),0) //refcnt=1 step2: disable vlan filter feature and enable real_dev step3: change filter from 0 to 1 vlan_device_event vlan_filter_push_vids ndo_vlan_rx_add_vid //No refcnt added to real_dev vlan0 step4: real_dev down vlan_device_event vlan_vid_del(dev, htons(ETH_P_8021Q), 0); //refcnt=0 vlan_info_rcu_free //free vlan0 step5: delete vlan0 unregister_vlan_dev BUG_ON(!vlan_info); //vlan_info is null Fix both problems by noting in the VLAN info whether VLAN 0 was automatically added upon NETDEV_UP and based on that decide whether it should be deleted upon NETDEV_DOWN, regardless of the state of the "rx-vlan-filter" feature. [1] unreferenced object 0xffff8880068e3100 (size 256): comm "ip", pid 384, jiffies 4296130254 hex dump (first 32 bytes): 00 20 30 0d 80 88 ff ff 00 00 00 00 00 00 00 00 . 0............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 81ce31fa): __kmalloc_cache_noprof+0x2b5/0x340 vlan_vid_add+0x434/0x940 vlan_device_event.cold+0x75/0xa8 notifier_call_chain+0xca/0x150 __dev_notify_flags+0xe3/0x250 rtnl_configure_link+0x193/0x260 rtnl_newlink_create+0x383/0x8e0 __rtnl_newlink+0x22c/0xa40 rtnl_newlink+0x627/0xb00 rtnetlink_rcv_msg+0x6fb/0xb70 netlink_rcv_skb+0x11f/0x350 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 [2] kernel BUG at net/8021q/vlan.c:99! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 382 Comm: ip Not tainted 6.16.0-rc3 #61 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:unregister_vlan_dev (net/8021q/vlan.c:99 (discriminator 1)) RSP: 0018:ffff88810badf310 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88810da84000 RCX: ffffffffb47ceb9a RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88810e8b43c8 RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6cefe80 R10: ffffffffb677f407 R11: ffff88810badf3c0 R12: ffff88810e8b4000 R13: 0000000000000000 R14: ffff88810642a5c0 R15: 000000000000017e FS: 00007f1ff68c20c0(0000) GS:ffff888163a24000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1ff5dad240 CR3: 0000000107e56000 CR4: 00000000000006f0 Call Trace: <TASK ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ad1afb00393915a51c21b1ae8704562bf036855f , < ba48d3993af23753e1f1f01c8d592de9c7785f24 (git)
Affected: ad1afb00393915a51c21b1ae8704562bf036855f , < 35142b3816832889e50164d993018ea5810955ae (git)
Affected: ad1afb00393915a51c21b1ae8704562bf036855f , < 047b61a24d7c866c502aeeea482892969a68f216 (git)
Affected: ad1afb00393915a51c21b1ae8704562bf036855f , < d43ef15bf4856c8c4c6c3572922331a5f06deb77 (git)
Affected: ad1afb00393915a51c21b1ae8704562bf036855f , < bb515c41306454937464da055609b5fb0a27821b (git)
Affected: ad1afb00393915a51c21b1ae8704562bf036855f , < 8984bcbd1edf5bee5be06ad771d157333b790c33 (git)
Affected: ad1afb00393915a51c21b1ae8704562bf036855f , < 93715aa2d80e6c5cea1bb486321fc4585076928b (git)
Affected: ad1afb00393915a51c21b1ae8704562bf036855f , < 579d4f9ca9a9a605184a9b162355f6ba131f678d (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.36
Unaffected: 0 , < 2.6.36 (semver)
Unaffected: 5.4.297 , ≤ 5.4.* (semver)
Unaffected: 5.10.241 , ≤ 5.10.* (semver)
Unaffected: 5.15.190 , ≤ 5.15.* (semver)
Unaffected: 6.1.147 , ≤ 6.1.* (semver)
Unaffected: 6.6.100 , ≤ 6.6.* (semver)
Unaffected: 6.12.40 , ≤ 6.12.* (semver)
Unaffected: 6.15.8 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:38:35.299Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:42:08.952Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/8021q/vlan.c",
            "net/8021q/vlan.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba48d3993af23753e1f1f01c8d592de9c7785f24",
              "status": "affected",
              "version": "ad1afb00393915a51c21b1ae8704562bf036855f",
              "versionType": "git"
            },
            {
              "lessThan": "35142b3816832889e50164d993018ea5810955ae",
              "status": "affected",
              "version": "ad1afb00393915a51c21b1ae8704562bf036855f",
              "versionType": "git"
            },
            {
              "lessThan": "047b61a24d7c866c502aeeea482892969a68f216",
              "status": "affected",
              "version": "ad1afb00393915a51c21b1ae8704562bf036855f",
              "versionType": "git"
            },
            {
              "lessThan": "d43ef15bf4856c8c4c6c3572922331a5f06deb77",
              "status": "affected",
              "version": "ad1afb00393915a51c21b1ae8704562bf036855f",
              "versionType": "git"
            },
            {
              "lessThan": "bb515c41306454937464da055609b5fb0a27821b",
              "status": "affected",
              "version": "ad1afb00393915a51c21b1ae8704562bf036855f",
              "versionType": "git"
            },
            {
              "lessThan": "8984bcbd1edf5bee5be06ad771d157333b790c33",
              "status": "affected",
              "version": "ad1afb00393915a51c21b1ae8704562bf036855f",
              "versionType": "git"
            },
            {
              "lessThan": "93715aa2d80e6c5cea1bb486321fc4585076928b",
              "status": "affected",
              "version": "ad1afb00393915a51c21b1ae8704562bf036855f",
              "versionType": "git"
            },
            {
              "lessThan": "579d4f9ca9a9a605184a9b162355f6ba131f678d",
              "status": "affected",
              "version": "ad1afb00393915a51c21b1ae8704562bf036855f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/8021q/vlan.c",
            "net/8021q/vlan.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "lessThan": "2.6.36",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.147",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.147",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.100",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime\n\nAssuming the \"rx-vlan-filter\" feature is enabled on a net device, the\n8021q module will automatically add or remove VLAN 0 when the net device\nis put administratively up or down, respectively. There are a couple of\nproblems with the above scheme.\n\nThe first problem is a memory leak that can happen if the \"rx-vlan-filter\"\nfeature is disabled while the device is running:\n\n # ip link add bond1 up type bond mode 0\n # ethtool -K bond1 rx-vlan-filter off\n # ip link del dev bond1\n\nWhen the device is put administratively down the \"rx-vlan-filter\"\nfeature is disabled, so the 8021q module will not remove VLAN 0 and the\nmemory will be leaked [1].\n\nAnother problem that can happen is that the kernel can automatically\ndelete VLAN 0 when the device is put administratively down despite not\nadding it when the device was put administratively up since during that\ntime the \"rx-vlan-filter\" feature was disabled. null-ptr-unref or\nbug_on[2] will be triggered by unregister_vlan_dev() for refcount\nimbalance if toggling filtering during runtime:\n\n$ ip link add bond0 type bond mode 0\n$ ip link add link bond0 name vlan0 type vlan id 0 protocol 802.1q\n$ ethtool -K bond0 rx-vlan-filter off\n$ ifconfig bond0 up\n$ ethtool -K bond0 rx-vlan-filter on\n$ ifconfig bond0 down\n$ ip link del vlan0\n\nRoot cause is as below:\nstep1: add vlan0 for real_dev, such as bond, team.\nregister_vlan_dev\n    vlan_vid_add(real_dev,htons(ETH_P_8021Q),0) //refcnt=1\nstep2: disable vlan filter feature and enable real_dev\nstep3: change filter from 0 to 1\nvlan_device_event\n    vlan_filter_push_vids\n        ndo_vlan_rx_add_vid //No refcnt added to real_dev vlan0\nstep4: real_dev down\nvlan_device_event\n    vlan_vid_del(dev, htons(ETH_P_8021Q), 0); //refcnt=0\n        vlan_info_rcu_free //free vlan0\nstep5: delete vlan0\nunregister_vlan_dev\n    BUG_ON(!vlan_info); //vlan_info is null\n\nFix both problems by noting in the VLAN info whether VLAN 0 was\nautomatically added upon NETDEV_UP and based on that decide whether it\nshould be deleted upon NETDEV_DOWN, regardless of the state of the\n\"rx-vlan-filter\" feature.\n\n[1]\nunreferenced object 0xffff8880068e3100 (size 256):\n  comm \"ip\", pid 384, jiffies 4296130254\n  hex dump (first 32 bytes):\n    00 20 30 0d 80 88 ff ff 00 00 00 00 00 00 00 00  . 0.............\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc 81ce31fa):\n    __kmalloc_cache_noprof+0x2b5/0x340\n    vlan_vid_add+0x434/0x940\n    vlan_device_event.cold+0x75/0xa8\n    notifier_call_chain+0xca/0x150\n    __dev_notify_flags+0xe3/0x250\n    rtnl_configure_link+0x193/0x260\n    rtnl_newlink_create+0x383/0x8e0\n    __rtnl_newlink+0x22c/0xa40\n    rtnl_newlink+0x627/0xb00\n    rtnetlink_rcv_msg+0x6fb/0xb70\n    netlink_rcv_skb+0x11f/0x350\n    netlink_unicast+0x426/0x710\n    netlink_sendmsg+0x75a/0xc20\n    __sock_sendmsg+0xc1/0x150\n    ____sys_sendmsg+0x5aa/0x7b0\n    ___sys_sendmsg+0xfc/0x180\n\n[2]\nkernel BUG at net/8021q/vlan.c:99!\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 0 UID: 0 PID: 382 Comm: ip Not tainted 6.16.0-rc3 #61 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:unregister_vlan_dev (net/8021q/vlan.c:99 (discriminator 1))\nRSP: 0018:ffff88810badf310 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff88810da84000 RCX: ffffffffb47ceb9a\nRDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88810e8b43c8\nRBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6cefe80\nR10: ffffffffb677f407 R11: ffff88810badf3c0 R12: ffff88810e8b4000\nR13: 0000000000000000 R14: ffff88810642a5c0 R15: 000000000000017e\nFS:  00007f1ff68c20c0(0000) GS:ffff888163a24000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f1ff5dad240 CR3: 0000000107e56000 CR4: 00000000000006f0\nCall Trace:\n \u003cTASK\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered exclusively through local configuration interfaces \u2014 RTM_NEWLINK/RTM_DELLINK/link up-down over rtnetlink plus ETHTOOL_SFEATURES via the ethtool ioctl/netlink path. No remote packet processing is involved.\nAC:L - The refcount imbalance is produced by a fixed, deterministic sequence of configuration commands (create VLAN 0, disable rx-vlan-filter, bring device up, re-enable filter, bring device down, delete VLAN), with no race to win and no dependence on memory layout the attacker cannot influence.\nPR:L - Both gates are namespace-relative \u2014 rtnetlink uses netlink_net_capable(skb, CAP_NET_ADMIN) and dev_ethtool() uses ns_capable(net-\u003euser_ns, CAP_NET_ADMIN) \u2014 so an unprivileged user obtains them via `unshare -Urn`, and bonding/team devices with a toggleable NETIF_F_HW_VLAN_CTAG_FILTER can be created entirely inside that namespace.\nUI:N - The attacker performs every step of the sequence themselves within their own network namespace; no victim action or cooperation is required.\nS:U - The corruption and its consequences are confined to the kernel\u0027s own memory and networking state, with no crossing into a different security authority such as a hypervisor or IOMMU boundary.\nC:H - The premature free of vlan_info leaves an orphaned GARP/MRP applicant whose periodic timer reads a freed struct net_device (mtu, needed_headroom) to size and populate skbs that are then transmitted, disclosing reclaimed kernel heap contents; per kernel scoring practice a use-after-free is scored High.\nI:H - The leaked applicant timer drives dev_queue_xmit() on a freed net_device, dereferencing netdev_ops function pointers from memory the attacker can heap-spray into during the ~250 ms timer window, yielding control-flow hijack potential; the unchecked NULL-array write in vlan_group_set_device() and the nr_vlan_devs underflow further corrupt kernel state.\nA:H - The primary reported outcome is `kernel BUG at net/8021q/vlan.c:99` (invalid opcode oops) or a NULL-pointer dereference, with the faulting task dying while holding RTNL and thereby wedging all subsequent network configuration; the variant also leaks vlan_info and netdev references, causing a permanent \"waiting for \u003cdev\u003e to become free\" unregister hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:09.041Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ba48d3993af23753e1f1f01c8d592de9c7785f24"
        },
        {
          "url": "https://git.kernel.org/stable/c/35142b3816832889e50164d993018ea5810955ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/047b61a24d7c866c502aeeea482892969a68f216"
        },
        {
          "url": "https://git.kernel.org/stable/c/d43ef15bf4856c8c4c6c3572922331a5f06deb77"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb515c41306454937464da055609b5fb0a27821b"
        },
        {
          "url": "https://git.kernel.org/stable/c/8984bcbd1edf5bee5be06ad771d157333b790c33"
        },
        {
          "url": "https://git.kernel.org/stable/c/93715aa2d80e6c5cea1bb486321fc4585076928b"
        },
        {
          "url": "https://git.kernel.org/stable/c/579d4f9ca9a9a605184a9b162355f6ba131f678d"
        }
      ],
      "title": "net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38470",
    "datePublished": "2025-07-28T11:21:32.002Z",
    "dateReserved": "2025-04-16T04:51:24.020Z",
    "dateUpdated": "2026-08-05T12:02:09.041Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38470",
      "date": "2026-09-16",
      "epss": "0.00174",
      "percentile": "0.07112"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-24T14:40:11.000Z",
      "cve": "CVE-2025-38470",
      "id": "msrc_CVE-2025-38470",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38470.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38470\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-28T12:15:28.760\",\"lastModified\":\"2026-07-30T06:23:18.397\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime\\n\\nAssuming the \\\"rx-vlan-filter\\\" feature is enabled on a net device, the\\n8021q module will automatically add or remove VLAN 0 when the net device\\nis put administratively up or down, respectively. There are a couple of\\nproblems with the above scheme.\\n\\nThe first problem is a memory leak that can happen if the \\\"rx-vlan-filter\\\"\\nfeature is disabled while the device is running:\\n\\n # ip link add bond1 up type bond mode 0\\n # ethtool -K bond1 rx-vlan-filter off\\n # ip link del dev bond1\\n\\nWhen the device is put administratively down the \\\"rx-vlan-filter\\\"\\nfeature is disabled, so the 8021q module will not remove VLAN 0 and the\\nmemory will be leaked [1].\\n\\nAnother problem that can happen is that the kernel can automatically\\ndelete VLAN 0 when the device is put administratively down despite not\\nadding it when the device was put administratively up since during that\\ntime the \\\"rx-vlan-filter\\\" feature was disabled. null-ptr-unref or\\nbug_on[2] will be triggered by unregister_vlan_dev() for refcount\\nimbalance if toggling filtering during runtime:\\n\\n$ ip link add bond0 type bond mode 0\\n$ ip link add link bond0 name vlan0 type vlan id 0 protocol 802.1q\\n$ ethtool -K bond0 rx-vlan-filter off\\n$ ifconfig bond0 up\\n$ ethtool -K bond0 rx-vlan-filter on\\n$ ifconfig bond0 down\\n$ ip link del vlan0\\n\\nRoot cause is as below:\\nstep1: add vlan0 for real_dev, such as bond, team.\\nregister_vlan_dev\\n    vlan_vid_add(real_dev,htons(ETH_P_8021Q),0) //refcnt=1\\nstep2: disable vlan filter feature and enable real_dev\\nstep3: change filter from 0 to 1\\nvlan_device_event\\n    vlan_filter_push_vids\\n        ndo_vlan_rx_add_vid //No refcnt added to real_dev vlan0\\nstep4: real_dev down\\nvlan_device_event\\n    vlan_vid_del(dev, htons(ETH_P_8021Q), 0); //refcnt=0\\n        vlan_info_rcu_free //free vlan0\\nstep5: delete vlan0\\nunregister_vlan_dev\\n    BUG_ON(!vlan_info); //vlan_info is null\\n\\nFix both problems by noting in the VLAN info whether VLAN 0 was\\nautomatically added upon NETDEV_UP and based on that decide whether it\\nshould be deleted upon NETDEV_DOWN, regardless of the state of the\\n\\\"rx-vlan-filter\\\" feature.\\n\\n[1]\\nunreferenced object 0xffff8880068e3100 (size 256):\\n  comm \\\"ip\\\", pid 384, jiffies 4296130254\\n  hex dump (first 32 bytes):\\n    00 20 30 0d 80 88 ff ff 00 00 00 00 00 00 00 00  . 0.............\\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\\n  backtrace (crc 81ce31fa):\\n    __kmalloc_cache_noprof+0x2b5/0x340\\n    vlan_vid_add+0x434/0x940\\n    vlan_device_event.cold+0x75/0xa8\\n    notifier_call_chain+0xca/0x150\\n    __dev_notify_flags+0xe3/0x250\\n    rtnl_configure_link+0x193/0x260\\n    rtnl_newlink_create+0x383/0x8e0\\n    __rtnl_newlink+0x22c/0xa40\\n    rtnl_newlink+0x627/0xb00\\n    rtnetlink_rcv_msg+0x6fb/0xb70\\n    netlink_rcv_skb+0x11f/0x350\\n    netlink_unicast+0x426/0x710\\n    netlink_sendmsg+0x75a/0xc20\\n    __sock_sendmsg+0xc1/0x150\\n    ____sys_sendmsg+0x5aa/0x7b0\\n    ___sys_sendmsg+0xfc/0x180\\n\\n[2]\\nkernel BUG at net/8021q/vlan.c:99!\\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\\nCPU: 0 UID: 0 PID: 382 Comm: ip Not tainted 6.16.0-rc3 #61 PREEMPT(voluntary)\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\\nBIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\nRIP: 0010:unregister_vlan_dev (net/8021q/vlan.c:99 (discriminator 1))\\nRSP: 0018:ffff88810badf310 EFLAGS: 00010246\\nRAX: 0000000000000000 RBX: ffff88810da84000 RCX: ffffffffb47ceb9a\\nRDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88810e8b43c8\\nRBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6cefe80\\nR10: ffffffffb677f407 R11: ffff88810badf3c0 R12: ffff88810e8b4000\\nR13: 0000000000000000 R14: ffff88810642a5c0 R15: 000000000000017e\\nFS:  00007f1ff68c20c0(0000) GS:ffff888163a24000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 00007f1ff5dad240 CR3: 0000000107e56000 CR4: 00000000000006f0\\nCall Trace:\\n \u003cTASK\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net:vlan: fix VLAN 0 refcount desequilibrio de alternancia de filtrado durante el tiempo de ejecuci\u00f3n. Suponiendo que la funci\u00f3n \\\"rx-vlan-filter\\\" est\u00e9 habilitada en un dispositivo de red, el m\u00f3dulo 8021q agregar\u00e1 o eliminar\u00e1 autom\u00e1ticamente la VLAN 0 cuando el dispositivo de red se active o desactive administrativamente, respectivamente. Existen un par de problemas con el esquema anterior. El primer problema es una fuga de memoria que puede ocurrir si la funci\u00f3n \\\"rx-vlan-filter\\\" est\u00e1 deshabilitada mientras el dispositivo est\u00e1 en ejecuci\u00f3n: # ip link add bond1 up type bond mode 0 # ethtool -K bond1 rx-vlan-filter off # ip link del dev bond1 Cuando el dispositivo se desactiva administrativamente, la funci\u00f3n \\\"rx-vlan-filter\\\" est\u00e1 deshabilitada, por lo que el m\u00f3dulo 8021q no eliminar\u00e1 la VLAN 0 y se producir\u00e1 una fuga de memoria [1]. Otro problema que puede ocurrir es que el kernel puede eliminar autom\u00e1ticamente la VLAN 0 cuando el dispositivo se pone administrativamente fuera de servicio a pesar de no haberla agregado cuando el dispositivo se puso administrativamente en servicio ya que durante ese tiempo la funci\u00f3n \\\"rx-vlan-filter\\\" estaba deshabilitada. null-ptr-unref o bug_on[2] se activar\u00e1n mediante unregister_vlan_dev() para el desequilibrio de refcount si se alterna el filtrado durante el tiempo de ejecuci\u00f3n: $ ip link add bond0 type bond mode 0 $ ip link add link bond0 name vlan0 type vlan id 0 protocol 802.1q $ ethtool -K bond0 rx-vlan-filter off $ ifconfig bond0 up $ ethtool -K bond0 rx-vlan-filter on $ ifconfig bond0 down $ ip link del vlan0 La causa ra\u00edz es la siguiente: paso 1: agregue vlan0 para real_dev, como bond, team. register_vlan_dev vlan_vid_add(real_dev,htons(ETH_P_8021Q),0) //refcnt=1 paso2: deshabilitar la funci\u00f3n de filtro de vlan y habilitar real_dev paso3: cambiar el filtro de 0 a 1 vlan_device_event vlan_filter_push_vids ndo_vlan_rx_add_vid //No se agreg\u00f3 refcnt a real_dev vlan0 paso4: real_dev inactivo vlan_device_event vlan_vid_del(dev, htons(ETH_P_8021Q), 0); //refcnt=0 vlan_info_rcu_free //liberar vlan0 paso5: eliminar vlan0 unregister_vlan_dev BUG_ON(!vlan_info); //vlan_info es nulo Corrija ambos problemas anotando en la informaci\u00f3n de VLAN si la VLAN 0 se agreg\u00f3 autom\u00e1ticamente en NETDEV_UP y en funci\u00f3n de eso decida si debe eliminarse en NETDEV_DOWN, independientemente del estado de la funci\u00f3n \\\"rx-vlan-filter\\\". [1] objeto sin referencia 0xffff8880068e3100 (tama\u00f1o 256): comm \\\"ip\\\", pid 384, jiffies 4296130254 hex dump (first 32 bytes): 00 20 30 0d 80 88 ff ff 00 00 00 00 00 00 00 00 . 0............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 81ce31fa): __kmalloc_cache_noprof+0x2b5/0x340 vlan_vid_add+0x434/0x940 vlan_device_event.cold+0x75/0xa8 notifier_call_chain+0xca/0x150 __dev_notify_flags+0xe3/0x250 rtnl_configure_link+0x193/0x260 rtnl_newlink_create+0x383/0x8e0 __rtnl_newlink+0x22c/0xa40 rtnl_newlink+0x627/0xb00 rtnetlink_rcv_msg+0x6fb/0xb70 netlink_rcv_skb+0x11f/0x350 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 [2] kernel BUG at net/8021q/vlan.c:99! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 382 Comm: ip Not tainted 6.16.0-rc3 #61 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:unregister_vlan_dev (net/8021q/vlan.c:99 (discriminator 1)) RSP: 0018:ffff88810badf310 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88810da84000 RCX: ffffffffb47ceb9a RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88810e8b43c8 RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6cefe80 R10: ffffffffb677f407 R11: ffff88810badf3c0 R12: ffff88810e8b4000 R13: 0000000000000000 R14: ffff88810642a5c0 R15: 000000000000017e FS: 00007f1ff68c20c0(0000) GS:ffff888163a24000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/8021q/vlan.c\",\"net/8021q/vlan.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ad1afb00393915a51c21b1ae8704562bf036855f\",\"lessThan\":\"ba48d3993af23753e1f1f01c8d592de9c7785f24\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ad1afb00393915a51c21b1ae8704562bf036855f\",\"lessThan\":\"35142b3816832889e50164d993018ea5810955ae\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ad1afb00393915a51c21b1ae8704562bf036855f\",\"lessThan\":\"047b61a24d7c866c502aeeea482892969a68f216\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ad1afb00393915a51c21b1ae8704562bf036855f\",\"lessThan\":\"d43ef15bf4856c8c4c6c3572922331a5f06deb77\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ad1afb00393915a51c21b1ae8704562bf036855f\",\"lessThan\":\"bb515c41306454937464da055609b5fb0a27821b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ad1afb00393915a51c21b1ae8704562bf036855f\",\"lessThan\":\"8984bcbd1edf5bee5be06ad771d157333b790c33\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ad1afb00393915a51c21b1ae8704562bf036855f\",\"lessThan\":\"93715aa2d80e6c5cea1bb486321fc4585076928b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ad1afb00393915a51c21b1ae8704562bf036855f\",\"lessThan\":\"579d4f9ca9a9a605184a9b162355f6ba131f678d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/8021q/vlan.c\",\"net/8021q/vlan.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.36\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.36\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.297\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.241\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.190\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.147\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.100\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.40\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.8\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.36\",\"versionEndExcluding\":\"5.4.297\",\"matchCriteriaId\":\"E4B3ABE2-43D9-443F-B2FA-0F8264FD6861\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.241\",\"matchCriteriaId\":\"D0D21C35-EB8A-488A-BBF9-403E4817E5DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.190\",\"matchCriteriaId\":\"AD9E597F-3DDE-4D7E-976C-463D0611F13F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.147\",\"matchCriteriaId\":\"A4FD62FC-0DAE-4ACE-8C9C-66156518C3E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.100\",\"matchCriteriaId\":\"094B81E0-B756-4727-85CA-F3F8D1C9D116\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.40\",\"matchCriteriaId\":\"0099D5A4-B157-4D36-8858-982C7D579030\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.8\",\"matchCriteriaId\":\"C7AFE5B0-F3B1-4D30-B8BF-EDA0385C4746\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"85421F4E-C863-4ABF-B4B4-E887CC2F7F92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3827F0D4-5FEE-4181-B267-5A45E7CA11FC\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/047b61a24d7c866c502aeeea482892969a68f216\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/35142b3816832889e50164d993018ea5810955ae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/579d4f9ca9a9a605184a9b162355f6ba131f678d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8984bcbd1edf5bee5be06ad771d157333b790c33\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/93715aa2d80e6c5cea1bb486321fc4585076928b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ba48d3993af23753e1f1f01c8d592de9c7785f24\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bb515c41306454937464da055609b5fb0a27821b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d43ef15bf4856c8c4c6c3572922331a5f06deb77\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-082556.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:08:40+00:00",
      "cve": "CVE-2025-38470",
      "id": "CVE-2025-38470",
      "initial_release_date": "2025-07-28T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38470.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:18:43Z",
      "cve": "CVE-2025-38470",
      "id": "CVE-2025-38470",
      "initial_release_date": "2025-07-28T23:22:57Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "700",
      "product_status:recommended": "623",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38470",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38470.json",
      "version": "56"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.