Critical Vulnerability in Linux Kernel: idpf RSS Key Size Issue
Summary
DEBIAN-CVE-2025-38402: In the Linux kernel, the following vulnerability has been resolved: idpf: return 0 size for RSS key if not supported Returning -EOPNOTSUPP from function returning u32 is leading to cast and invalid size value as a result... Affects linux versions < 6.12.37-1. Fixed in 6.12.37-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages hardware resources and provides essential services for software applications. The kernel is designed to be robust and secure, but vulnerabilities can arise, potentially compromising system integrity. This specific vulnerability affects the idpf component, which is responsible for handling Receive Side Scaling (RSS) keys. When devices lack RSS capabilities, the kernel may return an invalid size, leading to allocation failures.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the idpf component where the function returning the size of the RSS key incorrectly returns -EOPNOTSUPP for unsupported devices. This misrepresentation can lead to invalid size values, resulting in memory allocation failures. The vulnerability is triggered when executing the command 'ethtool -x eth0' on devices without RSS capabilities. The call trace indicates a series of function calls leading to this erroneous behavior, which could potentially crash the system or cause instability.
How To Fix
Minimum fixed version
6.12.37-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if you are unable to update the kernel immediately, you can avoid using the 'ethtool -x eth0' command on devices that do not support RSS capabilities. This will prevent the triggering of the vulnerability until a proper update can be applied.
Conclusion
The identified vulnerability in the Linux kernel related to the idpf component poses a significant risk to system stability. It is crucial for users to update their systems to the patched version to mitigate potential issues. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes or instability due to memory allocation failures when the RSS key size is incorrectly reported.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, a patch is available in version 6.12.37-1 of the Linux package. Updating to this version will resolve the issue.
As a workaround, avoid using the 'ethtool -x eth0' command on unsupported devices to prevent triggering the vulnerability.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38402.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
