CVE-2025-38124

Q: What is the severity of CVE-2025-38124?

CVE-2025-38124 has a CVSS score of 5.5 (MEDIUM). A memory corruption vulnerability in the Linux kernel's UDP Generic Segmentation Offload (GSO) implementation can cause kernel panics when processing specially crafted network packets. Systems running affected Linux kernel versions with UDP GSO enabled are vulnerable, particularly those using NAT, BPF hooks, or other packet modification features.

5.5 MEDIUM

Denial of Service

📋 TL;DR

A memory corruption vulnerability in the Linux kernel's UDP Generic Segmentation Offload (GSO) implementation can cause kernel panics when processing specially crafted network packets. Systems running affected Linux kernel versions with UDP GSO enabled are vulnerable, particularly those using NAT, BPF hooks, or other packet modification features.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE description; check kernel commit references for exact ranges.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires UDP GSO to be enabled and packet modification features like NAT or BPF hooks that can break fraglist invariants.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially affecting multiple systems in a network.

🟠

Likely Case

System crash or instability when processing malformed UDP packets, causing service disruption.

🟢

If Mitigated

No impact if patched or UDP GSO is disabled.

🌐 Internet-Facing: MEDIUM - Requires sending specially crafted UDP packets to vulnerable systems, but UDP is commonly exposed.

🏢 Internal Only: MEDIUM - Internal systems could be affected by malicious internal traffic or misconfigured network devices.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires crafting UDP packets that trigger the fraglist geometry violation, which may require specific network conditions or packet modifications.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check kernel commits: 0e65f38bd1aa14ea86e221b7bb814d38278d86c3, 3382a1ed7f778db841063f5d7e317ac55f9e7f72, 4399f59a9467a324ed46657555f0e1f209a14acb, 85eef1748c024da1a191aed56b30a3a65958c50c, a04302867094bdc6efac1b598370fc47cf3f2388

Vendor Advisory: https://git.kernel.org/stable/c/0e65f38bd1aa14ea86e221b7bb814d38278d86c3

Restart Required: Yes

Instructions:

1. Update Linux kernel to a version containing the fix commits. 2. Reboot the system to load the new kernel.

🔧 Temporary Workarounds

Disable UDP GSO

linux

Disable UDP Generic Segmentation Offload to prevent the vulnerable code path from being triggered.

ethtool -K <interface> gso off
ethtool -K <interface> gro off

🧯 If You Can't Patch

Implement network filtering to block suspicious UDP traffic to vulnerable systems.
Isolate vulnerable systems from untrusted networks and limit internal network exposure.

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with patched versions in kernel commit references.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes one of the fix commits: 0e65f38bd1aa14ea86e221b7bb814d38278d86c3, 3382a1ed7f778db841063f5d7e317ac55f9e7f72, 4399f59a9467a324ed46657555f0e1f209a14acb, 85eef1748c024da1a191aed56b30a3a65958c50c, or a04302867094bdc6efac1b598370fc47cf3f2388.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages mentioning skb_segment, UDP GSO, or fraglist segmentation
System crash logs with call stack including skb_segment+0xcd0

Network Indicators:

Unusual UDP packet patterns that might trigger fraglist geometry violations

SIEM Query:

Search for kernel logs containing 'skb_segment' or 'UDP GSO' error messages.

📊 Metadata

CVE ID: CVE-2025-38124

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

EPSS Score: 0.03% exploit probability (7th percentile)

Published: July 3, 2025

Last Updated: December 17, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable UDP GSO

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities