VLAN 0 Refcount Imbalance in Linux Kernel - CVE-2025-38470
Summary
CVE-2025-38470: In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Assuming the "rx-vlan-filter" feature is enabled on a net device, the 8021... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports various functionalities, including process management, memory management, and device control. The kernel is modular, allowing for the addition of features like VLAN (Virtual Local Area Network) support, which enables network segmentation. However, vulnerabilities can arise in these features, leading to potential security risks.
Vulnerability Detail
CVE-2025-38470 is a vulnerability in the Linux kernel related to the VLAN feature. It arises from a refcount imbalance when toggling the 'rx-vlan-filter' feature on network devices. When this feature is disabled while the device is running, it can lead to a memory leak. Additionally, the kernel may automatically delete VLAN 0 when the device is administratively down, even if it was not added when the device was up, causing a null pointer dereference or a bug on refcount imbalance. This vulnerability can lead to system instability and potential denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid toggling the 'rx-vlan-filter' feature while the device is running. This can be done by ensuring that the feature is set correctly before bringing the device up or down. For example, use the following commands:
- To bring the device up: ip link set dev <device_name> up
- To disable the VLAN filter feature before bringing the device down: ethtool -K <device_name> rx-vlan-filter off
- Then bring the device down: ip link set dev <device_name> down
Conclusion
CVE-2025-38470 is a significant vulnerability in the Linux kernel that can lead to memory leaks and system instability. Users are encouraged to update their kernel to the patched version to mitigate risks. Temporary workarounds are available, but the best course of action is to apply the fix as soon as possible.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38470 is a vulnerability in the Linux kernel that affects the VLAN feature, leading to potential memory leaks and system instability.
This vulnerability can cause memory leaks and may lead to system crashes or denial of service if exploited.
Yes, a patch is available in the updated versions of the Linux kernel. Users should upgrade to the latest version to mitigate the risk.
As a temporary measure, avoid toggling the 'rx-vlan-filter' feature while the device is running to minimize the risk.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
