VDB

CVE-2025-38146

CVE-2025-38146 PUBLISHED CVSS 9.4 CRITICAL

net: openvswitch: Fix the dead loop of MPLS parse

Reported by linux · Published July 3, 2025

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix the dead loop of MPLS parse The unexpected MPLS packet may not end with the bottom label stack. When there are many stacks, The label count value has wrapped around. A dead loop occurs, soft lockup/CPU stuck finally. stack backtrace: UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26 index -1 is out of range for type '__be32 [3]' CPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G OE 5.15.0-121-generic #131-Ubuntu Hardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021 Call Trace: <IRQ> show_stack+0x52/0x5c dump_stack_lvl+0x4a/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x36 __ubsan_handle_out_of_bounds.cold+0x44/0x49 key_extract_l3l4+0x82a/0x840 [openvswitch] ? kfree_skbmem+0x52/0xa0 key_extract+0x9c/0x2b0 [openvswitch] ovs_flow_key_extract+0x124/0x350 [openvswitch] ovs_vport_receive+0x61/0xd0 [openvswitch] ? kernel_init_free_pages.part.0+0x4a/0x70 ? get_page_from_freelist+0x353/0x540 netdev_port_receive+0xc4/0x180 [openvswitch] ? netdev_port_receive+0x180/0x180 [openvswitch] netdev_frame_hook+0x1f/0x40 [openvswitch] __netif_receive_skb_core.constprop.0+0x23a/0xf00 __netif_receive_skb_list_core+0xfa/0x240 netif_receive_skb_list_internal+0x18e/0x2a0 napi_complete_done+0x7a/0x1c0 bnxt_poll+0x155/0x1c0 [bnxt_en] __napi_poll+0x30/0x180 net_rx_action+0x126/0x280 ? bnxt_msix+0x67/0x80 [bnxt_en] handle_softirqs+0xda/0x2d0 irq_exit_rcu+0x96/0xc0 common_interrupt+0x8e/0xa0 </IRQ>

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
kernel-livepatch-6.1.144-170.251Amazon Linux1:1.0-0.amzn2023
python3-perfAmazon Linux1:6.1.144-170.251.amzn2023
kernel-libbpfAmazon Linux6.12.35-55.103.amzn2023
kernel-tools-develAmazon Linux6.12.35-55.103.amzn2023
kernel6.12Amazon Linux6.12.35-55.103.amzn2023
bpftoolAmazon Linux6.12.35-55.103.amzn2023
kernel-livepatch-6.12.35-55.103Amazon Linux1.0-0.amzn2023
kernelAmazon Linux1:6.1.144-170.251.amzn2023
kernel-toolsAmazon Linux6.12.35-55.103.amzn2023
linux_kernellinux6.15.3, 6.12.34, 6.6.94, 6.1.142, 5.15.186, 5.10.239

Risk scores

CVSS 3.1
9.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Affected products

VendorProductVersions
LinuxLinuxfbdcdd78da7c95f1b970d371e1b23cbd3aa990f3, fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3, fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3
LinuxLinux5.5, 0, 5.10.239
amazon:2023kernel-livepatch-6.1.144-170.2510
amazon:2023python3-perf0
amazon:2023kernel-libbpf0
amazon:2023kernel-tools-devel0
amazon:2023kernel6.120
amazon:2023bpftool0
amazon:2023kernel-livepatch-6.12.35-55.1030
amazon:2023kernel0
amazon:2023kernel-tools0
linuxlinux_kernel5.5, 5.5, 5.5
amazon:2023kernel-libbpf-devel0
amazon:2023kernel6.12-modules-extra0
amazon:2023kernel-modules-extra-common0
amazon:2023perf6.120
amazon:2023kernel-devel0
amazon:2023kernel-libbpf-static0
amazon:2023kernel-modules-extra0
amazon:2023perf0

…and 3 more

Timeline

  • Jul 2, 2025 CVE Published
  • Jul 3, 2025 EPSS Score (30 in total, the first dated here)
  • Oct 12, 2025 PoC Published (11 in total, the first dated here)
  • Mar 29, 2026 Distribution Patch (224 in total, the first dated here)
  • Mar 29, 2026 Security Advisory (238 in total, the first dated here)
  • Jun 9, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2025-38146
vulnetix vdb fixes CVE-2025-38146

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-38146/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›