Cyber Resilience

CVE-2025-38569

Memory Safety in Linux Kernel 5.4.291 – 5.4.297

Published
19 August 2025
Modified
17 June 2026
Patch / advisory
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0017 7th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-38569 is a medium-severity NULL Pointer Dereference (CWE-476) vulnerability in Linux Linux Kernel. Its CVSS base score is 5.5 (Medium).

Operationally, ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-16 (Memory Protection) and SC-39 (Process Isolation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

In the Linux kernel, the following vulnerability has been resolved: benet: fix BUG when creating VFs benet crashes as soon as SRIOV VFs are created: kernel BUG at mm/vmalloc.c:3457! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 4 UID:…

more

0 PID: 7408 Comm: test.sh Kdump: loaded Not tainted 6.16.0+ #1 PREEMPT(voluntary) [...] RIP: 0010:vunmap+0x5f/0x70 [...] Call Trace: <TASK> __iommu_dma_free+0xe8/0x1c0 be_cmd_set_mac_list+0x3fe/0x640 [be2net] be_cmd_set_mac+0xaf/0x110 [be2net] be_vf_eth_addr_config+0x19f/0x330 [be2net] be_vf_setup+0x4f7/0x990 [be2net] be_pci_sriov_configure+0x3a1/0x470 [be2net] sriov_numvfs_store+0x20b/0x380 kernfs_fop_write_iter+0x354/0x530 vfs_write+0x9b9/0xf60 ksys_write+0xf3/0x1d0 do_syscall_64+0x8c/0x3d0 be_cmd_set_mac_list() calls dma_free_coherent() under a spin_lock_bh. Fix it by freeing only after the lock has been released.

CWE(s)

Related Threats

CVEs Like This One

CVE-2025-38020Same product: Debian Debian Linux
CVE-2025-38364Same product: Debian Debian Linux
CVE-2025-37844Same product: Debian Debian Linux
CVE-2025-38304Same product: Debian Debian Linux
CVE-2025-38683Same product: Debian Debian Linux
CVE-2024-26744Same product: Debian Debian Linux
CVE-2025-37958Same product: Debian Debian Linux
CVE-2025-38319Same product: Debian Debian Linux
CVE-2025-38634Same product: Debian Debian Linux
CVE-2023-52686Same product: Debian Debian Linux

Affected Assets

linux
linux kernel
6.14 · 5.4.291 — 5.4.297 · 5.10.235 — 5.10.241 · 5.15.179 — 5.15.190
debian
debian linux
11.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-16 Memory Protection
  • SC-39 Process Isolation
  • SI-7 Software, Firmware, and Information Integrity
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Memory Protection directly blocks the invalid vunmap/dma_free_coherent call under spin_lock that triggers the kernel BUG.

prevent

Process Isolation limits the blast radius of the benet driver fault during VF creation so a single VF config cannot crash the whole kernel.

preventdetect

Software, Firmware, and Information Integrity mechanisms can detect or block execution of the flawed be2net driver binary containing the locking violation.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices (static analysis, code review, safe coding standards) directly prevent NULL dereference bugs during development.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect NULL dereference defects before release.

prevents

Secure SDLC mandates defensive coding practices that can prevent NULL dereferences.

prevents

Application security requirements can specify input validation and pointer-safety rules.

prevents

Secure architecture principles encourage defensive design that avoids unsafe pointer use.

prevents

Secure coding standards directly require NULL-pointer checks and safe dereference patterns.

References