CVE-2025-38310 — Buffer Access with Incorrect Length Value in Linux

CWE-805 — Buffer Access with Incorrect Length Value69 documents8 sources
Severity
5.5MEDIUMNVD
OSV3.2
EPSS
0.0%
top 93.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
LinuxLinux KernelDebian Linux
Timeline
PublishedJul 10
Latest updateMar 25

Description

In the Linux kernel, the following vulnerability has been resolved: seg6: Fix validation of nexthop addresses The kernel currently validates that the length of the provided nexthop address does not exceed the specified length. This can lead to the kernel reading uninitialized memory if user space provided a shorter length than the specified one. Fix by validating that the provided length exactly matches the specified one.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶NVDlinux/linux_kernel4.14 — 5.15.186+4
▶Debianlinux/linux_kernel< 6.1.147-1+2
▶Ubuntulinux/linux_kernel< 5.15.0-156.166+1
▶CVEListV5linux/linuxd1df6fd8a1d22d37cffa0075ab8ad423ce656777 — 668923c474608dd9ebce0fbcc41bd8a27aa73dd6+6

Also affects: Debian Linux 11.0

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

35
OSV
linux-azure-6.8 vulnerabilities↗2026-03-25
▶
OSV
linux-azure-fips vulnerabilities↗2026-03-04
▶
OSV
linux-azure vulnerabilities↗2026-03-04
▶
OSV
linux-ibm, linux-ibm-6.8 vulnerabilities↗2026-02-24
▶
OSV
linux-xilinx vulnerabilities↗2026-02-24
▶

📋Vendor Advisories

33
Ubuntu
Linux kernel (Azure) vulnerabilities↗2026-03-25
▶
Ubuntu
Linux kernel (Azure) vulnerabilities↗2026-03-04
▶
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities↗2026-03-04
▶
Ubuntu
Linux kernel (Xilinx) vulnerabilities↗2026-02-24
▶
Ubuntu
Linux kernel (IBM) vulnerabilities↗2026-02-24
▶
CVE-2025-38310 — Linux vulnerability | cvebase