CVE-2025-38569: linux kernel +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2025-38569

CVSS 5.5 · Medium EPSS 0,17%

Kerentanan NULL Pointer Dereference pada linux kernel, debian linux. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: benet: fix BUG when creating VFs benet crashes as soon as SRIOV VFs are created: kernel BUG at mm/vmalloc.c:3457! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 4 UID: 0 PID: 7408 Comm: test.sh Kdump: loaded Not tainted 6.16.0+ #1 PREEMPT(voluntary) [...] RIP: 0010:vunmap+0x5f/0x70 [...] Call Trace: <TASK> __iommu_dma_free+0xe8/0x1c0 be_cmd_set_mac_list+0x3fe/0x640 [be2net] be_cmd_set_mac+0xaf/0x110 [be2net] be_vf_eth_addr_config+0x19f/0x330 [be2net] be_vf_setup+0x4f7/0x990 [be2net] be_pci_sriov_configure+0x3a1/0x470 [be2net] sriov_numvfs_store+0x20b/0x380 kernfs_fop_write_iter+0x354/0x530 vfs_write+0x9b9/0xf60 ksys_write+0xf3/0x1d0 do_syscall_64+0x8c/0x3d0 be_cmd_set_mac_list() calls dma_free_coherent() under a spin_lock_bh. Fix it by freeing only after the lock has been released.

Rincian

Terbit di NVD: 19 Agustus 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-476: NULL Pointer Dereference
EPSS (30 hari): 0,17% peluang dieksploitasi; lebih tinggi dari 6,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
linux	linux kernel	Versi 5.4.291 hingga sebelum 5.4.297
linux	linux kernel	Versi 5.10.235 hingga sebelum 5.10.241
linux	linux kernel	Versi 5.15.179 hingga sebelum 5.15.190
linux	linux kernel	Versi 6.1.131 hingga sebelum 6.1.148
linux	linux kernel	Versi 6.6.83 hingga sebelum 6.6.102
linux	linux kernel	Versi 6.12.19 hingga sebelum 6.12.42
linux	linux kernel	Versi 6.13.7 hingga sebelum 6.14
linux	linux kernel	Versi 6.14.1 hingga sebelum 6.15.10
linux	linux kernel	Versi 6.16 hingga sebelum 6.16.1
linux	linux kernel	Versi 6.14
linux	linux kernel	Versi 6.14 rc6
linux	linux kernel	Versi 6.14 rc7
debian	debian linux	Versi 11.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://git.kernel.org/stable/c/0ddfe8b127ef1149fddccb79db6e6eaba7738e7d patch
https://git.kernel.org/stable/c/3697e37e012bbd2bb5a5b467689811ba097b2eff patch
https://git.kernel.org/stable/c/46d44a23a3723a89deeb65b13cddb17f8d9f2700 patch
https://git.kernel.org/stable/c/5a40f8af2ba1b9bdf46e2db10e8c9710538fbc63 patch
https://git.kernel.org/stable/c/975e73b9102d844a3dc3f091ad631c56145c8b4c patch
https://git.kernel.org/stable/c/c377ba2be9430d165a98e4b782902ed630bc7546 patch
https://git.kernel.org/stable/c/d5dc09ee5d74277bc47193fe28ce8703e229331b patch
https://git.kernel.org/stable/c/f4e4e0c4bc4d799d6fa39055acdbc3af066cd13e patch
https://git.kernel.org/stable/c/f80b34ebc579216407b128e9d155bfcae875c30f patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html mailing list · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html mailing list · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.