Login Sign Up

CVE-2025-38622

5.5 MEDIUM
Denial of Service

📋 TL;DR

A kernel panic vulnerability in the Linux kernel's UDP processing allows remote attackers to crash affected systems by sending specially crafted UDP packets with UFO (UDP Fragmentation Offload) segmentation. This affects Linux systems using tun devices with virtio_net_hdr and UDP_ENCAP_ESPINUDP encapsulation. The vulnerability can be triggered remotely without authentication.

💻 Affected Systems

Products:
  • Linux kernel
Versions: Versions before the fix commits (specific versions vary by distribution, generally Linux kernel versions before the fix was backported)
Operating Systems: Linux distributions using affected kernel versions
Default Config Vulnerable: ✅ No
Notes: Requires specific configuration: tun device with virtio_net_hdr, UDP_ENCAP_ESPINUDP encapsulation enabled, and UFO (UDP Fragmentation Offload) packets. Not vulnerable in default configurations.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote kernel panic leading to complete system crash and denial of service, potentially affecting multiple systems if exploited at scale.

🟠

Likely Case

Targeted denial of service attacks against vulnerable Linux servers, causing service disruption and potential data loss from unsaved operations.

🟢

If Mitigated

No impact if systems are patched or don't use the specific tun device configuration with UDP encapsulation.

🌐 Internet-Facing: MEDIUM - Requires specific UDP encapsulation configuration (UDP_ENCAP_ESPINUDP) and tun device usage, but can be triggered remotely without authentication.
🏢 Internal Only: LOW - Same technical requirements apply, but internal network access provides additional attack vectors for targeted systems.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: MEDIUM

Exploitation requires knowledge of specific system configuration and ability to send crafted UDP packets. The vulnerability is in the kernel's UDP processing path, making it accessible to remote attackers with network access to vulnerable systems.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 0c639c6479ec, 0d45954034f8, 4c1022220b1b, 72f97d3cb791, 791f32c5eab3 (backported to stable branches)

Vendor Advisory: https://git.kernel.org/stable/c/0c639c6479ec4480372901a5fc566f7588cf5522

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Check distribution security advisories for specific version numbers. 3. Reboot system after kernel update to load new kernel.

🔧 Temporary Workarounds

Disable UFO on tun interfaces

Linux

Disable UDP Fragmentation Offload on tun devices to prevent triggering the vulnerability

ethtool -K <tun_interface> ufo off

Disable UDP_ENCAP_ESPINUDP encapsulation

Linux

Remove UDP encapsulation configuration if not required

Check and modify application configurations using UDP_ENCAP_ESPINUDP

🧯 If You Can't Patch

  • Implement network filtering to block UDP packets with suspicious fragmentation patterns
  • Isolate systems using tun devices with UDP encapsulation from untrusted networks

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if tun devices with UFO and UDP_ENCAP_ESPINUDP are configured. Use: uname -r and check /proc/net/tun

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and check that UFO packets are dropped in udp_rcv_segment() via kernel logs

📡 Detection & Monitoring

Log Indicators:

  • Kernel panic messages mentioning skb_pull_rcsum or udp_queue_rcv_one_skb
  • System crash/reboot logs
  • OOM killer activity following crashes

Network Indicators:

  • UDP packets with malformed fragmentation to systems with tun interfaces
  • Sudden increase in UDP traffic to specific ports using encapsulation

SIEM Query:

source="kernel" AND ("skb_pull_rcsum" OR "udp_queue_rcv_one_skb" OR "kernel BUG at net/core/skbuff.c")

📊 Metadata

CVE ID: CVE-2025-38622
CVSS v3 Score: 5.5 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score: 0.01% exploit probability (2.3th percentile)
Published: August 22, 2025
Last Updated: January 7, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON