CVE-2025-38735CWE-476

CVE-2025-38735

High · published September 5, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

gve: prevent ethtool ops after shutdown

A crash can occur if an ethtool operation is invoked

after shutdown() is called.

shutdown() is invoked during system shutdown to stop DMA operations

without performing expensive deallocations. It is discouraged to

unregister the netdev in this path, so the device may still be visible

to userspace and kernel helpers.

In gve, shutdown() tears down most internal data structures. If an

ethtool operation is dispatched after shutdown(), it will dereference

freed or NULL pointers, leading to a kernel panic. While graceful

shutdown normally quiesces userspace before invoking the reboot

syscall, forced shutdowns (as observed on GCP VMs) can still trigger

this path.

Fix by calling netif_device_detach() in shutdown().

This marks the device as detached so the ethtool ioctl handler

will skip dispatching operations to the driver.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00170 · 6.0th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2025-09-05T22:15Z
Affected products (7)
ProductVersionsFixed in
linux/linux_kernel≥ 5.17, < 6.1.1496.1.149
linux/linux_kernel≥ 6.2, < 6.6.1036.6.103
linux/linux_kernel≥ 6.7, < 6.12.446.12.44
linux/linux_kernel≥ 6.13, < 6.16.46.16.4
linux/linux_kernelall versions—
linux/linux_kernelall versions—
debian/debian_linuxall versions—
References (7)
EPSS history
Timeline
  • 05 SEP 17:20Z
    gve: prevent ethtool ops after shutdown
    cvelistv5