Skip to content
Fencer Vulns
medium 5.5

CVE-2025-38417 json

ice: fix eswitch code memory leak in reset scenario

published 2025-07-25 15 mo ago modified 2026-11-05 3 d ago also EUVD-2025-22669

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

ice: fix eswitch code memory leak in reset scenario

Add simple eswitch mode checker in attaching VF procedure and allocate required port representor memory structures only in switchdev mode. The reset flows triggers VF (if present) detach/attach procedure. It might involve VF port representor(s) re-creation if the device is configured is switchdev mode (not legacy one). The memory was blindly allocated in current implementation, regardless of the mode and not freed if in legacy mode.

Kmemeleak trace: unreferenced object (percpu) 0x7e3bce5b888458 (size 40): comm "bash", pid 1784, jiffies 4295743894 hex dump (first 32 bytes on cpu 45): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 0): pcpu_alloc_noprof+0x4c4/0x7c0 ice_repr_create+0x66/0x130 [ice] ice_repr_create_vf+0x22/0x70 [ice] ice_eswitch_attach_vf+0x1b/0xa0 [ice] ice_reset_all_vfs+0x1dd/0x2f0 [ice] ice_pci_err_resume+0x3b/0xb0 [ice] pci_reset_function+0x8f/0x120 reset_store+0x56/0xa0 kernfs_fop_write_iter+0x120/0x1b0 vfs_write+0x31c/0x430 ksys_write+0x61/0xd0 do_syscall_64+0x5b/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Testing hints (ethX is PF netdev): - create at least one VF echo 1 > /sys/class/net/ethX/device/sriov_numvfs - trigger the reset echo 1 > /sys/class/net/ethX/device/reset

Patch / fix

  • Linux Linux 6.12.35, 6.15.4, 6.16
  • linux Debian 14, Debian 13 6.12.35-1

debian advisories DEBIAN-CVE-2025-38417

  • linux-aws-6.14 Ubuntu 24.04 LTS 6.14.0-1015.15~24.04.1
  • linux-gcp-6.14 Ubuntu 24.04 LTS 6.14.0-1018.19~24.04.1
  • linux-oem-6.14 Ubuntu 24.04 LTS 6.14.0-1014.14
  • linux-azure-6.14 Ubuntu 24.04 LTS 6.14.0-1014.14~24.04.1
  • linux-riscv-6.14 Ubuntu 24.04 LTS 6.14.0-34.34.1~24.04.1
  • linux-oracle-6.14 Ubuntu 24.04 LTS 6.14.0-1015.15~24.04.1
  • linux-azure-nvidia-6.14 Ubuntu 24.04 LTS 6.14.0-1007.7
  • linux-realtime-6.14 Ubuntu Pro Realtime 24.04 LTS 6.14.0-1014.14~24.04.1

ubuntu advisories UBUNTU-CVE-2025-38417

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 10.0 6.12.0-55.29.1.el10_0
  • rv RHEL 10.0 6.12.0-55.29.1.el10_0
  • perf RHEL 10.0 6.12.0-55.29.1.el10_0
  • rtla RHEL 10.0 6.12.0-55.29.1.el10_0
  • libperf RHEL 10.0 6.12.0-55.29.1.el10_0
  • kernel-rt RHEL 10.0 6.12.0-55.29.1.el10_0
  • kernel-64k RHEL 10.0 6.12.0-55.29.1.el10_0
  • kernel-core RHEL 10.0 6.12.0-55.29.1.el10_0

red hat advisories RHSA-2025:14510RHSA-2025:14420

  • kernel-rt Linux Micro 6.2 6.12.0-160000.6.1
  • kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
  • kernel-source SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
  • kernel-default SLES 16.0, SLE High Availability Extension 16.0, Linux Micro 6.2 +1 more 6.12.0-160000.6.1
  • kernel-default-base SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1.160000.2.4
  • kernel-syms SLES 16.0, Linux Micro Extras 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
  • kernel-obs-qa SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.6.1
  • kernel-kvmsmall SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.6.1

suse advisories SUSE-SU-2025:21074-1SUSE-SU-2025:21139-1SUSE-SU-2026:20560-1SUSE-SU-2025:21179-1SUSE-SU-2025:03011-1SUSE-SU-2025:02997-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.6.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-kvmsmall openSUSE Leap 16.0 6.12.0-160000.6.1

opensuse advisories openSUSE-SU-2025:20081-1

  • kernel AlmaLinux 9 5.14.0-570.37.1.el9_6
  • rv AlmaLinux 9 5.14.0-570.37.1.el9_6
  • perf AlmaLinux 9 5.14.0-570.37.1.el9_6
  • rtla AlmaLinux 9 5.14.0-570.37.1.el9_6
  • libperf AlmaLinux 9 5.14.0-570.37.1.el9_6
  • kernel-rt AlmaLinux 9 5.14.0-570.37.1.el9_6
  • kernel-64k AlmaLinux 9 5.14.0-570.37.1.el9_6
  • kernel-core AlmaLinux 9 5.14.0-570.37.1.el9_6

almalinux advisories ALSA-2025:14420ALSA-2025:14510

  • kernel Rocky Linux 9 5.14.0-570.37.1.el9_6
  • kernel Rocky Linux 10 6.12.0-55.29.1.el10_0

rocky linux advisories RLSA-2025:14420RLSA-2025:14510

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-38417 updated cvss 4.7

kernel: ice: fix eswitch code memory leak in reset scenario

  • Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
    affected: no fix available
  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-570.37.1.el9_6, perf 5.14.0-570.37.1.el9_6, rtla 5.14.0-570.37.1.el9_6, python3-perf 5.14.0-570.37.1.el9_6, kernel-devel-matched 5.14.0-570.37.1.el9_6, kernel-64k-devel-matched 5.14.0-570.37.1.el9_6, +7 more
    fixed: vendor fix RHSA-2025:14420
  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-55.29.1.el10_0, perf 6.12.0-55.29.1.el10_0, rtla 6.12.0-55.29.1.el10_0, python3-perf 6.12.0-55.29.1.el10_0, kernel-devel-matched 6.12.0-55.29.1.el10_0, kernel-64k-devel-matched 6.12.0-55.29.1.el10_0, +7 more
    fixed: vendor fix RHSA-2025:14510
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-570.37.1.el9_6, kernel-64k 5.14.0-570.37.1.el9_6, kernel-core 5.14.0-570.37.1.el9_6, kernel-tools 5.14.0-570.37.1.el9_6, kernel-modules 5.14.0-570.37.1.el9_6, kernel-64k-core 5.14.0-570.37.1.el9_6, +27 more
    fixed: vendor fix RHSA-2025:14420
  • Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-55.29.1.el10_0, kernel-64k 6.12.0-55.29.1.el10_0, kernel-core 6.12.0-55.29.1.el10_0, kernel-tools 6.12.0-55.29.1.el10_0, kernel-modules 6.12.0-55.29.1.el10_0, kernel-64k-core 6.12.0-55.29.1.el10_0, +27 more
    fixed: vendor fix RHSA-2025:14510
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-570.37.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.37.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.37.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.37.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.37.1.el9_6
    fixed: vendor fix RHSA-2025:14420
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-55.29.1.el10_0, kernel-debuginfo-common-s390x 6.12.0-55.29.1.el10_0, kernel-debuginfo-common-x86_64 6.12.0-55.29.1.el10_0, kernel-debuginfo-common-aarch64 6.12.0-55.29.1.el10_0, kernel-debuginfo-common-ppc64le 6.12.0-55.29.1.el10_0
    fixed: vendor fix RHSA-2025:14510
  • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-570.37.1.el9_6, kernel-rt-64k 5.14.0-570.37.1.el9_6, kernel-rt-core 5.14.0-570.37.1.el9_6, kernel-rt-modules 5.14.0-570.37.1.el9_6, kernel-rt-64k-core 5.14.0-570.37.1.el9_6, kernel-rt-debug-core 5.14.0-570.37.1.el9_6, +14 more
    fixed: vendor fix RHSA-2025:14420
show 4 more
  • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-55.29.1.el10_0, kernel-rt-64k 6.12.0-55.29.1.el10_0, kernel-rt-core 6.12.0-55.29.1.el10_0, kernel-rt-modules 6.12.0-55.29.1.el10_0, kernel-rt-64k-core 6.12.0-55.29.1.el10_0, kernel-rt-debug-core 6.12.0-55.29.1.el10_0, +14 more
    fixed: vendor fix RHSA-2025:14510
  • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-570.37.1.el9_6, kernel-rt-kvm 5.14.0-570.37.1.el9_6, kernel-rt-core 5.14.0-570.37.1.el9_6, kernel-rt-modules 5.14.0-570.37.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.37.1.el9_6, kernel-rt-debug-core 5.14.0-570.37.1.el9_6, +6 more
    fixed: vendor fix RHSA-2025:14420
  • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-55.29.1.el10_0, kernel-rt-kvm 6.12.0-55.29.1.el10_0, kernel-rt-core 6.12.0-55.29.1.el10_0, kernel-rt-modules 6.12.0-55.29.1.el10_0, kernel-rt-debug-kvm 6.12.0-55.29.1.el10_0, kernel-rt-debug-core 6.12.0-55.29.1.el10_0, +6 more
    fixed: vendor fix RHSA-2025:14510
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 d ago

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Weakness
  • CWE-401 Missing Release of Memory after Effective Lifetime
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.