01 Record

CVE-2025-38683

hv_netvsc: Fix panic during namespace deletion with VF

UnratedPUBLISHEDCNA: Linux

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

hv_netvsc: Fix panic during namespace deletion with VF

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.17% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 7.0% of scored records. A rank, not a probability.
NVD base score: 5.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-10-19.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-09-04 15:32Z1 YR AGO

Last updated

2026-05-23 16:00Z5 MO AGO

Reserved

2025-04-16

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-476NULL Pointer DereferenceBase
CWE-820Missing SynchronizationBase

Data version

5.2

Document digest

8e29dbc5ca354513cbbb320e92a5e7d2e65bc51055e87653dd5291970d8cf789

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux3eb6aa870057da9f1304db660f68b9c2eb7e856d to < 3ca41ab55d23a0aa71661a5a56a8f06c11db90dc, b7a396f76ada277d049558db648389456458af65 to < 3467c4ebb334658c6fcf3eabb64a6e8b2135e010, 4faa6e3e66b3251eb4bf5761d2f3f0f14095aaca to < 4eff1e57a8ef98d70451b94e8437e458b27dd234, 62c85b9a0dd7471a362170323e1211ad98ff7b4b to < 2a70cbd1aef8b8be39992ab7b776ce1390091774, 4c262801ea60c518b5bebc22a09f5b78b3147da2 to < d036104947176d030bec64792d54e1b4f4c7f318, 4c262801ea60c518b5bebc22a09f5b78b3147da2 to < 5276896e6923ebe8c68573779d784aaf7d987cce, 4c262801ea60c518b5bebc22a09f5b78b3147da2 to < 4293f6c5ccf735b26afeb6825def14d830e0367b, 4c262801ea60c518b5bebc22a09f5b78b3147da2 to < 33caa208dba6fa639e8a92fd0c8320b652e5550c, 7abd221a55a61b6b2bf0e80f850bfc0ae75c7e01, 31a38a908c98aebc7a1104dab5f1ba199f234b7b, 04d748d4bd2d86739b159563f257e3dc5492c88d, 5.10.229 to < 5.10.241, 5.15.170 to < 5.15.190, 6.1.115 to < 6.1.149, 6.6.59 to < 6.6.103, 4.19.323 to < 4.20, 5.4.285 to < 5.5, 6.11.6 to < 6.12, 6.12—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/3ca41ab55d23a0aa71661a5a56a8f06c11db90dc
git.kernel.orghttps://git.kernel.org/stable/c/3467c4ebb334658c6fcf3eabb64a6e8b2135e010
git.kernel.orghttps://git.kernel.org/stable/c/4eff1e57a8ef98d70451b94e8437e458b27dd234
git.kernel.orghttps://git.kernel.org/stable/c/2a70cbd1aef8b8be39992ab7b776ce1390091774
git.kernel.orghttps://git.kernel.org/stable/c/d036104947176d030bec64792d54e1b4f4c7f318
git.kernel.orghttps://git.kernel.org/stable/c/5276896e6923ebe8c68573779d784aaf7d987cce
git.kernel.orghttps://git.kernel.org/stable/c/4293f6c5ccf735b26afeb6825def14d830e0367b
git.kernel.orghttps://git.kernel.org/stable/c/33caa208dba6fa639e8a92fd0c8320b652e5550c
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-032379.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.153-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.43-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.16.3-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.