CVE-2025-38735

What it actually does

The vulnerability is a use-after-free in the gve driver where ethtool operations dispatched after shutdown() dereference freed or NULL pointers, causing a kernel panic. shutdown() tears down internal structures without unregistering the netdev, and the fix attaches netif_device_detach() to skip further operations.

Why it matters to the business

Linux systems, especially container-optimized and cloud VMs, can suffer kernel crashes during forced shutdowns, leading to service outages, potential data corruption, and operational disruption. Widespread kernel deployment amplifies exposure across many environments.

How an attack unfolds

An attacker with local privileges initiates a forced shutdown (as seen on GCP VMs), then issues ethtool ioctls while the device remains visible but structures are already torn down. Threat actors such as VMSCAPE and those exploiting related container OS privilege escalations can chain this to achieve denial of service or facilitate further escalation.

How to fix it

Upgrade the Linux kernel to include commit 48a4e89d50e8ea52e800bc7865970b92fcf4647c, which adds netif_device_detach() in the gve shutdown path. Reboot after applying the fixed kernel version.

How to confirm the fix worked

Confirm the commit 48a4e89d50e8ea52e800bc7865970b92fcf4647c is present in the kernel tree and that netif_device_detach() is invoked inside gve_shutdown(). Reproduce by simulating forced shutdown followed by ethtool calls and verify no panic occurs.

Typical attack path

1. Gain local access on a Linux system running the vulnerable gve driver
2. Trigger a forced shutdown sequence that invokes driver shutdown()
3. Dispatch an ethtool operation via ioctl before full quiescence
4. Cause dereference of freed pointers resulting in kernel panic

How to detect it

Search kernel logs and dmesg for oops or panic messages referencing gve or ethtool operations immediately after shutdown events. Correlate forced reboot timestamps with subsequent crashes on container-optimized hosts.

• gve_shutdown
• netif_device_detach
• ethtool.*gve
• kernel panic.*gve

What your security team should do

• Prioritize kernel upgrade to the fixed commit across all affected systems
• Monitor kernel logs for panics involving gve during shutdown windows
• Limit unprivileged ethtool access via capabilities or SELinux policies until patched
• Test shutdown paths in staging environments that mimic cloud forced-reboot scenarios