CVE-2025-38664

Q: What is the severity of CVE-2025-38664?

CVE-2025-38664 has a CVSS score of 5.5 (MEDIUM). This CVE describes a null pointer dereference vulnerability in the Linux kernel's ice driver, which handles Intel Ethernet Connection network adapters. If exploited, it could cause a kernel panic or system crash, affecting systems using vulnerable versions of the Linux kernel with the ice driver loaded. The vulnerability requires local access to trigger.

5.5 MEDIUM

Denial of Service

📋 TL;DR

This CVE describes a null pointer dereference vulnerability in the Linux kernel's ice driver, which handles Intel Ethernet Connection network adapters. If exploited, it could cause a kernel panic or system crash, affecting systems using vulnerable versions of the Linux kernel with the ice driver loaded. The vulnerability requires local access to trigger.

💻 Affected Systems

Products:

Linux kernel with ice driver

Versions: Specific kernel versions containing the vulnerable code (check git commits for exact ranges)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only vulnerable when ice driver is loaded and active (typically on systems with Intel Ethernet Connection adapters).

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially causing data loss or service disruption.

🟠

Likely Case

System crash requiring reboot, resulting in temporary service interruption.

🟢

If Mitigated

Minimal impact with proper access controls preventing local users from triggering the vulnerability.

🌐 Internet-Facing: LOW - Requires local access to exploit, not directly reachable from internet.

🏢 Internal Only: MEDIUM - Local users or processes could trigger the crash, affecting system availability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger the specific code path in ice_copy_and_init_pkg().

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the fix commits (0fde7dccbf4c8a6d7940ecaf4c3d80a12f405dd7 and others)

Vendor Advisory: https://git.kernel.org/stable/c/0fde7dccbf4c8a6d7940ecaf4c3d80a12f405dd7

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from distribution vendor. 2. Rebuild kernel if using custom kernel. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Unload ice driver

Linux

Remove the vulnerable driver module if not needed

sudo rmmod ice

🧯 If You Can't Patch

Restrict local user access to systems with vulnerable driver
Implement monitoring for kernel panics and system crashes

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if ice module is loaded: lsmod | grep ice && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and check git commit history for fix inclusion

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/kern.log or dmesg
System crash/reboot events

Network Indicators:

Loss of network connectivity on affected interfaces

SIEM Query:

EventID=41 OR "kernel panic" OR "Oops" OR "ice" module crash

📊 Metadata

CVE ID: CVE-2025-38664

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.01% exploit probability (2.3th percentile)

Published: August 22, 2025

Last Updated: January 7, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Unload ice driver

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities