{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38533", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.023Z", "datePublished": "2025-08-16T11:12:25.978Z", "dateUpdated": "2026-08-05T12:02:43.501Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:43.501Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: libwx: fix the using of Rx buffer DMA\n\nThe wx_rx_buffer structure contained two DMA address fields: 'dma' and\n'page_dma'. However, only 'page_dma' was actually initialized and used\nto program the Rx descriptor. But 'dma' was uninitialized and used in\nsome paths.\n\nThis could lead to undefined behavior, including DMA errors or\nuse-after-free, if the uninitialized 'dma' was used. Althrough such\nerror has not yet occurred, it is worth fixing in the code." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The defective cache-maintenance calls live in the libwx NAPI receive path (`wx_clean_rx_irq` → `wx_get_rx_buffer`/`wx_dma_sync_frag`/`wx_alloc_rx_buffers`), driven entirely by frames the NIC receives, including IP traffic routed from arbitrary remote hosts. The frag-sync offset and length are taken directly from remote packet geometry, so an off-link attacker fully drives the code path.\nAC:L - `bi->dma` is deterministically zero on every ring configure (`memset` in `wx_configure_rx_ring`), so every refill and every received packet mis-syncs with 100% reliability — no race, no memory-layout dependency, no timing window. Simply directing traffic at the interface triggers it.\nPR:N - The path is reached from hardware interrupt/NAPI context on packet arrival, before any protocol parsing, authentication, or socket demultiplexing. An unauthenticated remote sender needs no credentials at all, and the buggy sync also fires on ordinary interface bring-up.\nUI:N - No victim action is needed; an administratively up interface processes attacker-supplied frames automatically. The initial buffer fill in `wx_configure_rx_ring` executes the bad sync even with no traffic.\nS:U - The device descriptor was programmed with the correct `page_dma`, so there is no IOMMU or DMA-boundary bypass — only CPU-side cache maintenance at a bogus address. Impact stays within the kernel's own security authority.\nC:H - Because the real Rx buffer is never invalidated for CPU access, `wx_build_skb()` copies whatever stale cache contents cover the page — residual kernel data or prior packets — into the skb and delivers it via `napi_gro_receive()` to local sockets or back onto the wire. That is an unbounded disclosure of kernel memory contents to a remote party.\nI:H - The skipped `for_device` clean lets dirty CPU cache lines write back over DMA'd packet data, and the bogus `dcache_inval_poc` over `phys_to_virt(0)` discards dirty cache lines belonging to unrelated kernel memory at physical page 0. This is silent kernel memory corruption at an address the driver does not own.\nA:H - On non-coherent platforms the cache-maintenance instruction is issued against `phys_to_virt(0)`, which is outside the linear map whenever DRAM does not start at physical 0, producing an unhandled kernel data abort; corruption of kernel data at physical page 0 likewise leads to a panic. Any remote packet stream sustains the condition." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/wangxun/libwx/wx_lib.c", "drivers/net/ethernet/wangxun/libwx/wx_type.h" ], "versions": [ { "version": "3c47e8ae113a68da47987750d9896e325d0aeedd", "lessThan": "027701180a7bcb64c42eab291133ef0c87b5b6c5", "status": "affected", "versionType": "git" }, { "version": "3c47e8ae113a68da47987750d9896e325d0aeedd", "lessThan": "ba7c793f96c1c2b944bb6f423d7243f3afc30fe9", "status": "affected", "versionType": "git" }, { "version": "3c47e8ae113a68da47987750d9896e325d0aeedd", "lessThan": "05c37b574997892a40a0e9b9b88a481566b2367d", "status": "affected", "versionType": "git" }, { "version": "3c47e8ae113a68da47987750d9896e325d0aeedd", "lessThan": "5fd77cc6bd9b368431a815a780e407b7781bcca0", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/wangxun/libwx/wx_lib.c", "drivers/net/ethernet/wangxun/libwx/wx_type.h" ], "versions": [ { "version": "6.3", "status": "affected" }, { "version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.100", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.40", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.8", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.100" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.40" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.15.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/027701180a7bcb64c42eab291133ef0c87b5b6c5" }, { "url": "https://git.kernel.org/stable/c/ba7c793f96c1c2b944bb6f423d7243f3afc30fe9" }, { "url": "https://git.kernel.org/stable/c/05c37b574997892a40a0e9b9b88a481566b2367d" }, { "url": "https://git.kernel.org/stable/c/5fd77cc6bd9b368431a815a780e407b7781bcca0" } ], "title": "net: libwx: fix the using of Rx buffer DMA", "x_generator": { "engine": "bippy-1.2.0" } } } }