CVE-2025-38238

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38238", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.996Z", "datePublished": "2025-07-09T10:42:23.538Z", "dateUpdated": "2026-10-15T21:52:12.048Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:00:36.529Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out\n\nWhen both the RHBA and RPA FDMI requests time out, fnic reuses a frame to\nsend ABTS for each of them. On send completion, this causes an attempt to\nfree the same frame twice that leads to a crash.\n\nFix crash by allocating separate frames for RHBA and RPA, and modify ABTS\nlogic accordingly.\n\nTested by checking MDS for FDMI information.\n\nTested by using instrumented driver to:\n\n - Drop PLOGI response\n - Drop RHBA response\n - Drop RPA response\n - Drop RHBA and RPA response\n - Drop PLOGI response + ABTS response\n - Drop RHBA response + ABTS response\n - Drop RPA response + ABTS response\n - Drop RHBA and RPA response + ABTS response for both of them"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The trigger is entirely controlled by the FCoE fabric peer \u2014 withholding both the FDMI RHBA and RPA responses after accepting the FDMI PLOGI \u2014 and FCoE/FIP is a non-routable layer-2 protocol confined to the shared FCoE VLAN/storage fabric, so the attacker must be on the same broadcast domain (or be the unauthenticated FCF, which FIP allows spoofing).\nAC:L - No race and no memory-layout precondition: the attacker simply does not answer the two FDMI registration requests, which deterministically drives fdls_fdmi_timer_callback() into fdls_send_fdmi_abts() with both REG_HBA_PENDING and RPA_PENDING set, sending the one allocated frame twice.\nPR:N - The attacker is a remote fabric peer with no account or privileges on the target host; the FDMI exchange is initiated automatically by the driver during fabric login and requires no local access whatsoever.\nUI:N - FDMI is enabled by default (fnic_fdmi_support = 1) and fnic_fdls_start_plogi() launches the FDMI sequence automatically on fabric PLOGI/link-up; no administrator or user action is needed.\nS:U - The double free corrupts the kernel slab allocator within the same security authority as the vulnerable driver; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The slab double-free hands the same 2112-byte object to two independent consumers, letting one exchange's kernel data be transmitted onto the fabric to the attacker, and freelist corruption on a mergeable cache is a standard stepping stone to arbitrary kernel memory disclosure.\nI:H - A double kmem_cache_free() of a live object is the canonical heap-corruption primitive \u2014 freelist poisoning and overlapping allocations yield a controlled write, compounded by the double dma_unmap_single() and the OX_ID write into an already-DMA-mapped buffer.\nA:H - The fix commit exists precisely because the second free crashes the kernel in fnic_wq_cmpl_handler; the resulting allocator corruption reliably panics the machine and takes the FC storage path down with it."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/fnic/fdls_disc.c", "drivers/scsi/fnic/fnic.h", "drivers/scsi/fnic/fnic_fdls.h"], "versions": [{"version": "09c1e6ab4ab2a107d96f119950dc330e446dc2b0", "lessThan": "09679e9abedfbc5a2590759a1a7893c1c26e6044", "status": "affected", "versionType": "git"}, {"version": "09c1e6ab4ab2a107d96f119950dc330e446dc2b0", "lessThan": "a35b29bdedb4d2ae3160d4d6684a6f1ecd9ca7c2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/fnic/fdls_disc.c", "drivers/scsi/fnic/fnic.h", "drivers/scsi/fnic/fnic_fdls.h"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.5", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.15.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/09679e9abedfbc5a2590759a1a7893c1c26e6044"}, {"url": "https://git.kernel.org/stable/c/a35b29bdedb4d2ae3160d4d6684a6f1ecd9ca7c2"}], "title": "scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38238", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:48:43.685518Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:12.048Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38238", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:48:43.685518Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:48:44.575Z"}}], "cna": {"title": "scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The trigger is entirely controlled by the FCoE fabric peer \u2014 withholding both the FDMI RHBA and RPA responses after accepting the FDMI PLOGI \u2014 and FCoE/FIP is a non-routable layer-2 protocol confined to the shared FCoE VLAN/storage fabric, so the attacker must be on the same broadcast domain (or be the unauthenticated FCF, which FIP allows spoofing).\nAC:L - No race and no memory-layout precondition: the attacker simply does not answer the two FDMI registration requests, which deterministically drives fdls_fdmi_timer_callback() into fdls_send_fdmi_abts() with both REG_HBA_PENDING and RPA_PENDING set, sending the one allocated frame twice.\nPR:N - The attacker is a remote fabric peer with no account or privileges on the target host; the FDMI exchange is initiated automatically by the driver during fabric login and requires no local access whatsoever.\nUI:N - FDMI is enabled by default (fnic_fdmi_support = 1) and fnic_fdls_start_plogi() launches the FDMI sequence automatically on fabric PLOGI/link-up; no administrator or user action is needed.\nS:U - The double free corrupts the kernel slab allocator within the same security authority as the vulnerable driver; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The slab double-free hands the same 2112-byte object to two independent consumers, letting one exchange's kernel data be transmitted onto the fabric to the attacker, and freelist corruption on a mergeable cache is a standard stepping stone to arbitrary kernel memory disclosure.\nI:H - A double kmem_cache_free() of a live object is the canonical heap-corruption primitive \u2014 freelist poisoning and overlapping allocations yield a controlled write, compounded by the double dma_unmap_single() and the OX_ID write into an already-DMA-mapped buffer.\nA:H - The fix commit exists precisely because the second free crashes the kernel in fnic_wq_cmpl_handler; the resulting allocator corruption reliably panics the machine and takes the FC storage path down with it."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "09c1e6ab4ab2a107d96f119950dc330e446dc2b0", "lessThan": "09679e9abedfbc5a2590759a1a7893c1c26e6044", "versionType": "git"}, {"status": "affected", "version": "09c1e6ab4ab2a107d96f119950dc330e446dc2b0", "lessThan": "a35b29bdedb4d2ae3160d4d6684a6f1ecd9ca7c2", "versionType": "git"}], "programFiles": ["drivers/scsi/fnic/fdls_disc.c", "drivers/scsi/fnic/fnic.h", "drivers/scsi/fnic/fnic_fdls.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"status": "unaffected", "version": "0", "lessThan": "6.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.15.5", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/scsi/fnic/fdls_disc.c", "drivers/scsi/fnic/fnic.h", "drivers/scsi/fnic/fnic_fdls.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/09679e9abedfbc5a2590759a1a7893c1c26e6044"}, {"url": "https://git.kernel.org/stable/c/a35b29bdedb4d2ae3160d4d6684a6f1ecd9ca7c2"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out\n\nWhen both the RHBA and RPA FDMI requests time out, fnic reuses a frame to\nsend ABTS for each of them. On send completion, this causes an attempt to\nfree the same frame twice that leads to a crash.\n\nFix crash by allocating separate frames for RHBA and RPA, and modify ABTS\nlogic accordingly.\n\nTested by checking MDS for FDMI information.\n\nTested by using instrumented driver to:\n\n - Drop PLOGI response\n - Drop RHBA response\n - Drop RPA response\n - Drop RHBA and RPA response\n - Drop PLOGI response + ABTS response\n - Drop RHBA response + ABTS response\n - Drop RPA response + ABTS response\n - Drop RHBA and RPA response + ABTS response for both of them"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.5", "versionStartIncluding": "6.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16", "versionStartIncluding": "6.14"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:00:36.529Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38238", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:12.048Z", "dateReserved": "2025-04-16T04:51:23.996Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-07-09T10:42:23.538Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/scsi/fnic/fdls_disc.c", "drivers/scsi/fnic/fnic.h", "drivers/scsi/fnic/fnic_fdls.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "09679e9abedfbc5a2590759a1a7893c1c26e6044", "status": "affected", "version": "09c1e6ab4ab2a107d96f119950dc330e446dc2b0", "versionType": "git"}, {"lessThan": "a35b29bdedb4d2ae3160d4d6684a6f1ecd9ca7c2", "status": "affected", "version": "09c1e6ab4ab2a107d96f119950dc330e446dc2b0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/scsi/fnic/fdls_disc.c", "drivers/scsi/fnic/fnic.h", "drivers/scsi/fnic/fnic_fdls.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B778A5DA-B42B-4637-8580-7B4583B0061B", "versionEndExcluding": "6.15.5", "versionStartIncluding": "6.14", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*", "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*", "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*", "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out\n\nWhen both the RHBA and RPA FDMI requests time out, fnic reuses a frame to\nsend ABTS for each of them. On send completion, this causes an attempt to\nfree the same frame twice that leads to a crash.\n\nFix crash by allocating separate frames for RHBA and RPA, and modify ABTS\nlogic accordingly.\n\nTested by checking MDS for FDMI information.\n\nTested by using instrumented driver to:\n\n - Drop PLOGI response\n - Drop RHBA response\n - Drop RPA response\n - Drop RHBA and RPA response\n - Drop PLOGI response + ABTS response\n - Drop RHBA response + ABTS response\n - Drop RPA response + ABTS response\n - Drop RHBA and RPA response + ABTS response for both of them"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: fnic: Se corrige el fallo en fnic_wq_cmpl_handler cuando se agota el tiempo de espera de FDMI. Cuando se agota el tiempo de espera de las solicitudes FDMI de RHBA y RPA, fnic reutiliza una trama para enviar ABTS para cada una de ellas. Al completarse el env\u00edo, esto provoca un intento de liberar la misma trama dos veces, lo que provoca un fallo. Se corrige el fallo asignando tramas separadas para RHBA y RPA y modificando la l\u00f3gica de ABTS seg\u00fan corresponda. Se prob\u00f3 verificando MDS para obtener informaci\u00f3n de FDMI. Se prob\u00f3 utilizando un controlador instrumentado para: - Descartar la respuesta PLOGI - Descartar la respuesta RHBA - Descartar la respuesta RPA - Descartar la respuesta RHBA y RPA - Descartar la respuesta PLOGI + respuesta ABTS - Descartar la respuesta RHBA + respuesta ABTS - Descartar la respuesta RPA + respuesta ABTS - Descartar la respuesta RHBA y RPA + respuesta ABTS para ambas."}], "id": "CVE-2025-38238", "lastModified": "2026-10-15T22:18:36.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38238", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:48:43.685518Z", "version": "2.0.3"}}]}, "published": "2025-07-09T11:15:25.080", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/09679e9abedfbc5a2590759a1a7893c1c26e6044"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a35b29bdedb4d2ae3160d4d6684a6f1ecd9ca7c2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out", "id": "2378975", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2378975"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-38238", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38238\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38238\nhttps://lore.kernel.org/linux-cve-announce/2025070930-CVE-2025-38238-dae2@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-13T21:08:04.965934+00:00", "updated": "2025-07-13T21:08:04.966001+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}