Answer in brief
CVE-2025-38683 records a Medium severity (CVSS 5.5) vulnerability in hv_netvsc: Fix panic during namespace deletion with VF. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC CN 4100 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC CN 4100 (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.12:-:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.12:rc7:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=3eb6aa870057da9f1304db660f68b9c2eb7e856d <3ca41ab55d23a0aa71661a5a56a8f06c11db90dc || >=b7a396f76ada277d049558db648389456458af65 <3467c4ebb334658c6fcf3eabb64a6e8b2135e010 || >=4faa6e3e66b3251eb4bf5761d2f3f0f14095aaca <4eff1e57a8ef98d70451b94e8437e458b27dd234 || >=62c85b9a0dd7471a362170323e1211ad98ff7b4b <2a70cbd1aef8b8be39992ab7b776ce1390091774 || >=4c262801ea60c518b5bebc22a09f5b78b3147da2 <d036104947176d030bec64792d54e1b4f4c7f318 || >=4c262801ea60c518b5bebc22a09f5b78b3147da2 <5276896e6923ebe8c68573779d784aaf7d987cce || >=4c262801ea60c518b5bebc22a09f5b78b3147da2 <4293f6c5ccf735b26afeb6825def14d830e0367b || >=4c262801ea60c518b5bebc22a09f5b78b3147da2 <33caa208dba6fa639e8a92fd0c8320b652e5550c || 7abd221a55a61b6b2bf0e80f850bfc0ae75c7e01 || 31a38a908c98aebc7a1104dab5f1ba199f234b7b || 04d748d4bd2d86739b159563f257e3dc5492c88d || >=5.10.229 <5.10.241 || >=5.15.170 <5.15.190 || >=6.1.115 <6.1.149 || >=6.6.59 <6.6.103 || >=4.19.323 <4.20 || >=5.4.285 <5.5 || >=6.11.6 <6.12 | 3ca41ab55d23a0aa71661a5a56a8f06c11db90dc, 3467c4ebb334658c6fcf3eabb64a6e8b2135e010, 4eff1e57a8ef98d70451b94e8437e458b27dd234, 2a70cbd1aef8b8be39992ab7b776ce1390091774, d036104947176d030bec64792d54e1b4f4c7f318, 5276896e6923ebe8c68573779d784aaf7d987cce, 4293f6c5ccf735b26afeb6825def14d830e0367b, 33caa208dba6fa639e8a92fd0c8320b652e5550c, 5.10.241, 5.15.190, 6.1.149, 6.6.103, 4.20, 5.5, 6.12 |
| Linux/Linuxgeneric | 6.12 | Not reported |
| Siemens/SIMATIC CN 4100generic | >=0 <V5.0 | V5.0 |
Published upstream
Sep 4, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 28, 2026
In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, default_device_exit_batch() >> default_device_exit_net() is called. When netvsc NIC is moved back and registered to the default namespace, it automatically brings VF NIC back to the default namespace. This will cause the default_device_exit_net() >> for_each_netdev_safe loop unable to detect the list end, and hit NULL ptr: [ 231.449420] mana 7870:00:00.0 enP30832s1: Moved VF to namespace with: eth0 [ 231.449656] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 231.450246] #PF: supervisor read access in kernel mode [ 231.450579] #PF: error_code(0x0000) - not-present page [ 231.450916] PGD 17b8a8067 P4D 0 [ 231.451163] Oops: Oops: 0000 [#1] SMP NOPTI [ 231.451450] CPU: 82 UID: 0 PID: 1394 Comm: kworker/u768:1 Not tainted 6.16.0-rc4+ #3 VOLUNTARY [ 231.452042] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/21/2024 [ 231.452692] Workqueue: netns cleanup_net [ 231.452947] RIP: 0010:default_device_exit_batch+0x16c/0x3f0 [ 231.453326] Code: c0 0c f5 b3 e8 d5 db fe ff 48 85 c0 74 15 48 c7 c2 f8 fd ca b2 be 10 00 00 00 48 8d 7d c0 e8 7b 77 25 00 49 8b 86 28 01 00 00 <48> 8b 50 10 4c 8b 2a 4c 8d 62 f0 49 83 ed 10 4c 39 e0 0f 84 d6 00 [ 231.454294] RSP: 0018:ff75fc7c9bf9fd00 EFLAGS: 00010246 [ 231.454610] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 61c8864680b583eb [ 231.455094] RDX: ff1fa9f71462d800 RSI: ff75fc7c9bf9fd38 RDI: 0000000030766564 [ 231.455686] RBP: ff75fc7c9bf9fd78 R08: 0000000000000000 R09: 0000000000000000 [ 231.456126] R10: 0000000000000001 R11: 0000000000000004 R12: ff1fa9f70088e340 [ 231.456621] R13: ff1fa9f70088e340 R14: ffffffffb3f50c20 R15: ff1fa9f7103e6340 [ 231.457161] FS: 0000000000000000(0000) GS:ff1faa6783a08000(0000) knlGS:0000000000000000 [ 231.457707] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 231.458031] CR2: 0000000000000010 CR3: 0000000179ab2006 CR4: 0000000000b73ef0 [ 231.458434] Call Trace: [ 231.458600] <TASK> [ 231.458777] ops_undo_list+0x100/0x220 [ 231.459015] cleanup_net+0x1b8/0x300 [ 231.459285] process_one_work+0x184/0x340 To fix it, move the ns change to a workqueue, and take rtnl_lock to avoid changing the netdev list when default_device_exit_net() is using it.
Quoted source text, attributed separately from HOL analysis.