{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-37799", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.941Z", "datePublished": "2025-05-03T11:39:51.924Z", "dateUpdated": "2026-08-05T11:57:38.193Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:57:38.193Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp\n\nvmxnet3 driver's XDP handling is buggy for packet sizes using ring0 (that\nis, packet sizes between 128 - 3k bytes).\n\nWe noticed MTU-related connectivity issues with Cilium's service load-\nbalancing in case of vmxnet3 as NIC underneath. A simple curl to a HTTP\nbackend service where the XDP LB was doing IPIP encap led to overly large\npacket sizes but only for *some* of the packets (e.g. HTTP GET request)\nwhile others (e.g. the prior TCP 3WHS) looked completely fine on the wire.\n\nIn fact, the pcap recording on the backend node actually revealed that the\nnode with the XDP LB was leaking uninitialized kernel data onto the wire\nfor the affected packets, for example, while the packets should have been\n152 bytes their actual size was 1482 bytes, so the remainder after 152 bytes\nwas padded with whatever other data was in that page at the time (e.g. we\nsaw user/payload data from prior processed packets).\n\nWe only noticed this through an MTU issue, e.g. when the XDP LB node and\nthe backend node both had the same MTU (e.g. 1500) then the curl request\ngot dropped on the backend node's NIC given the packet was too large even\nthough the IPIP-encapped packet normally would never even come close to\nthe MTU limit. Lowering the MTU on the XDP LB (e.g. 1480) allowed to let\nthe curl request succeed (which also indicates that the kernel ignored the\npadding, and thus the issue wasn't very user-visible).\n\nCommit e127ce7699c1 (\"vmxnet3: Fix missing reserved tailroom\") was too eager\nto also switch xdp_prepare_buff() from rcd->len to rbi->len. It really needs\nto stick to rcd->len which is the actual packet length from the descriptor.\nThe latter we also feed into vmxnet3_process_xdp_small(), by the way, and\nit indicates the correct length needed to initialize the xdp->{data,data_end}\nparts. For e127ce7699c1 (\"vmxnet3: Fix missing reserved tailroom\") the\nrelevant part was adapting xdp_init_buff() to address the warning given the\nxdp_data_hard_end() depends on xdp->frame_sz. With that fixed, traffic on\nthe wire looks good again." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "baseScore": 8.6, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable code runs in the vmxnet3 RX path (`vmxnet3_rq_rx_complete` → `vmxnet3_process_xdp`) directly on frames received from the network, and the trigger condition is simply a packet whose length falls in the 128–3 K ring0 band, which a remote sender fully controls. The leaked kernel memory is then re-emitted on the wire via XDP_TX/XDP_REDIRECT or forwarded/bridged frames, so both the trigger and the disclosure channel are remote.\nAC:L - The attacker only needs to send ordinary packets of a chosen size; every such packet deterministically produces an over-long buffer, with no race, no memory-layout dependency, and no state the attacker cannot influence. XDP-on-vmxnet3 is a common deployed configuration (Cilium XDP load-balancing on VMware guests, the exact scenario reported), not a rare build-time option.\nPR:N - No credentials, session, or local account are needed — an unauthenticated remote host simply sends packets to the interface. The bug is hit in NAPI softirq context before any protocol-level authentication.\nUI:N - Processing occurs automatically in the driver's NAPI receive path with no victim action required. No local user must open, mount, or configure anything at exploitation time.\nS:U - The disclosed memory and the corrupted packets belong to the same kernel/host security authority as the vulnerable driver. There is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Up to ~3 KB of uninitialized kernel page memory per packet is exposed to the XDP program, to the local skb consumers, and — as confirmed by the reporter's pcap on the peer node — transmitted onto the wire, containing prior packets' user payloads and arbitrary stale page contents. The leak is attacker-triggerable at line rate, giving a sustained remote kernel-memory read channel.\nI:L - The kernel emits and delivers malformed packets whose length is inflated with unintended trailing data, corrupting frames as seen by remote peers, bridged/forwarded receivers, and raw-socket consumers. The modification is real but bounded and its content is not attacker-chosen.\nA:L - The oversized frames caused documented connectivity failures — legitimate requests dropped at the receiving NIC for exceeding MTU after encapsulation — degrading the network service. There is no kernel crash, hang, or out-of-bounds access, so the impact stays at degradation rather than full loss." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/vmxnet3/vmxnet3_xdp.c" ], "versions": [ { "version": "aba8659caf88017507419feea06069f529329ea6", "lessThan": "c4312c4d244aa58e811ff0297e013124d115e793", "status": "affected", "versionType": "git" }, { "version": "e127ce7699c1e05279ee5ee61f00893e7bfa9671", "lessThan": "33e131a10459d16f181c8184d3f17f1c318c7002", "status": "affected", "versionType": "git" }, { "version": "e127ce7699c1e05279ee5ee61f00893e7bfa9671", "lessThan": "e3ad76e36a37b0ff4a71b06d5b33530ee8c3a177", "status": "affected", "versionType": "git" }, { "version": "e127ce7699c1e05279ee5ee61f00893e7bfa9671", "lessThan": "4c2227656d9003f4d77afc76f34dd81b95e4c2c4", "status": "affected", "versionType": "git" }, { "version": "7c8505ecc2d15473d679b8e06335434b84fffe86", "status": "affected", "versionType": "git" }, { "version": "91d017d19d5a9ad153e2dc23ed3c0e2e79ef5262", "status": "affected", "versionType": "git" }, { "version": "6.6.23", "lessThan": "6.6.89", "status": "affected", "versionType": "semver" }, { "version": "6.7.11", "lessThan": "6.8", "status": "affected", "versionType": "semver" }, { "version": "6.8.2", "lessThan": "6.9", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/vmxnet3/vmxnet3_xdp.c" ], "versions": [ { "version": "6.9", "status": "affected" }, { "version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.89", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.26", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.5", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.23", "versionEndExcluding": "6.6.89" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.26" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.14.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.15" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c4312c4d244aa58e811ff0297e013124d115e793" }, { "url": "https://git.kernel.org/stable/c/33e131a10459d16f181c8184d3f17f1c318c7002" }, { "url": "https://git.kernel.org/stable/c/e3ad76e36a37b0ff4a71b06d5b33530ee8c3a177" }, { "url": "https://git.kernel.org/stable/c/4c2227656d9003f4d77afc76f34dd81b95e4c2c4" } ], "title": "vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp", "x_generator": { "engine": "bippy-1.2.0" } } } }