Cloudanix VulnDB

CVE-2025-38331

None

CVSS

—

EPSS

0.4%

Published

Jul 10, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A network driver bug in Linux can make certain hardware freeze and crash the system when handling ordinary internet traffic, causing unexpected outages until the software is updated.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The cortina ethernet driver fails to enable TOE/TSO offload for non-segmented TCP frames, causing hardware lockups and kernel crashes under load because the TOE engine cannot be decoupled from TSO.

Why it matters to the business

Systems using affected Cortina-based network hardware experience repeated network instability and crashes during normal TCP traffic, resulting in unplanned downtime and degraded network availability.

How an attack unfolds

An attacker generates sustained TCP traffic (for example via tools like iperf3) against a vulnerable system; the driver processes non-segmented frames without the required offload, triggering progressive hardware lockup that ends in a crash after minutes to hours depending on load.

How to fix it

Upgrade linux-lts packages to the fixed versions: Alpaquita 23 to 6.1.81-r0, Alpaquita stream to 6.6.58-r0 or 6.12.41-r0, and kernel GIT trees to commit 1b503b790109d19710ec83c589c3ee59e95347ec. Reboot after installation and verify the driver loads without lockups under load.

How to confirm the fix worked

Confirm the running kernel contains commit 1b503b790109d19710ec83c589c3ee59e95347ec, then run sustained iperf3 TCP tests and monitor for absence of hardware lockups or crashes in dmesg and kernel logs.

Typical attack path

  1. Identify systems exposing the cortina ethernet interface
  2. Establish a TCP connection and generate high-volume segmented and non-segmented traffic
  3. Sustain the load until the TOE/TSO mismatch causes driver lockup and system crash

How to detect it

Review kernel logs and dmesg for cortina driver lockup messages, repeated crashes under TCP load, and hardware watchdog resets; correlate with network interface utilization spikes on affected hardware.

What your security team should do

  • Apply the listed kernel updates immediately on all affected Alpaquita and upstream systems
  • Prioritize hosts handling production TCP traffic given the low but present EPSS trend increase
  • Add kernel crash and hardware lockup alerts to existing monitoring for the cortina driver

The record

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Use TOE/TSO on all TCP It is desireable to push the hardware accelerator to also process non-segmented TCP frames: we pass the skb->len to the "TOE/TSO" offloader and it will handle them. Without this quirk the driver becomes unstable and lock up and and crash. I do not know exactly why, but it is probably due to the TOE (TCP offload engine) feature that is coupled with the segmentation feature - it is not possible to turn one part off and not the other, either both TOE and TSO are active, or neither of them. Not having the TOE part active seems detrimental, as if that hardware feature is not really supposed to be turned off. The datasheet says: "Based on packet parsing and TCP connection/NAT table lookup results, the NetEngine puts the packets belonging to the same TCP connection to the same queue for the software to process. The NetEngine puts incoming packets to the buffer or series of buffers for a jumbo packet. With this hardware acceleration, IP/TCP header parsing, checksum validation and connection lookup are offloaded from the software processing." After numerous tests with the hardware locking up after something between minutes and hours depending on load using iperf3 I have concluded this is necessary to stabilize the hardware.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:12 linux 0 No fix
Debian:13 linux 0 6.12.35-1
Debian:14 linux 0 6.12.35-1
Linux Kernel 4.16.0 6.1.142
Mageia:9 kernel 0 6.6.101-1.mga9
Mageia:9 kernel-linus 0 6.6.101-1.mga9
Mageia:9 kmod-virtualbox 0 7.1.10-7.mga9
Mageia:9 kmod-xtables-addons 0 3.24-83.mga9
Mageia:9 wireless-regdb 0 20250710-1.mga9

Related vulnerabilities