Out-of-Bound Read Vulnerability in Linux Kernel's virtio-net

CVE-2025-38375

What is CVE-2025-38375?

A critical vulnerability exists in the Linux kernel's virtio-net component due to insufficient validation of received buffer lengths compared to allocated sizes. This oversight can lead to out-of-bounds reads during the processing of network data, potentially exposing sensitive information or allowing attackers to exploit system memory. A recent commit addresses this vulnerability by adding necessary checks to ensure received lengths do not exceed the allocated sizes.

References