Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-38490— net: libwx: remove duplicate page_pool_put_full_page()

CVSS 9.8 · Critical EPSS 0.29% · P22

Possible ATT&CK Techniques 1AI

T1562.001

Affected Version Matrix 10

VendorProductVersion RangeStatus
LinuxLinux3c47e8ae113a68da47987750d9896e325d0aeedd< 3c91a56762b1f0d1e4af2d86c2cba83b61ed9eaaaffected
3c47e8ae113a68da47987750d9896e325d0aeedd< 08d18bda0d03f5ec376929a8c6c4495f9594593aaffected
3c47e8ae113a68da47987750d9896e325d0aeedd< 003e4765d8661be97e650a833868c53d35574130affected
3c47e8ae113a68da47987750d9896e325d0aeedd< 1b7e585c04cd5f0731dd25ffd396277e55fae0e6affected
6.3affected
< 6.3unaffected
6.6.100≤ 6.6.*unaffected
6.12.40≤ 6.12.*unaffected
… +2 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-38490

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: libwx: remove duplicate page_pool_put_full_page()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: libwx: remove duplicate page_pool_put_full_page() page_pool_put_full_page() should only be invoked when freeing Rx buffers or building a skb if the size is too short. At other times, the pages need to be reused. So remove the redundant page put. In the original code, double free pages cause kernel panic: [ 876.949834] __irq_exit_rcu+0xc7/0x130 [ 876.949836] common_interrupt+0xb8/0xd0 [ 876.949838] </IRQ> [ 876.949838] <TASK> [ 876.949840] asm_common_interrupt+0x22/0x40 [ 876.949841] RIP: 0010:cpuidle_enter_state+0xc2/0x420 [ 876.949843] Code: 00 00 e8 d1 1d 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 cd fc 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d [ 876.949844] RSP: 0018:ffffaa7340267e78 EFLAGS: 00000246 [ 876.949845] RAX: ffff9e3f135be000 RBX: 0000000000000002 RCX: 0000000000000000 [ 876.949846] RDX: 000000cc2dc4cb7c RSI: ffffffff89ee49ae RDI: ffffffff89ef9f9e [ 876.949847] RBP: ffff9e378f940800 R08: 0000000000000002 R09: 00000000000000ed [ 876.949848] R10: 000000000000afc8 R11: ffff9e3e9e5a9b6c R12: ffffffff8a6d8580 [ 876.949849] R13: 000000cc2dc4cb7c R14: 0000000000000002 R15: 0000000000000000 [ 876.949852] ? cpuidle_enter_state+0xb3/0x420 [ 876.949855] cpuidle_enter+0x29/0x40 [ 876.949857] cpuidle_idle_call+0xfd/0x170 [ 876.949859] do_idle+0x7a/0xc0 [ 876.949861] cpu_startup_entry+0x25/0x30 [ 876.949862] start_secondary+0x117/0x140 [ 876.949864] common_startup_64+0x13e/0x148 [ 876.949867] </TASK> [ 876.949868] ---[ end trace 0000000000000000 ]--- [ 876.949869] ------------[ cut here ]------------ [ 876.949870] list_del corruption, ffffead40445a348->next is NULL [ 876.949873] WARNING: CPU: 14 PID: 0 at lib/list_debug.c:52 __list_del_entry_valid_or_report+0x67/0x120 [ 876.949875] Modules linked in: snd_hrtimer(E) bnep(E) binfmt_misc(E) amdgpu(E) squashfs(E) vfat(E) loop(E) fat(E) amd_atl(E) snd_hda_codec_realtek(E) intel_rapl_msr(E) snd_hda_codec_generic(E) intel_rapl_common(E) snd_hda_scodec_component(E) snd_hda_codec_hdmi(E) snd_hda_intel(E) edac_mce_amd(E) snd_intel_dspcfg(E) snd_hda_codec(E) snd_hda_core(E) amdxcp(E) kvm_amd(E) snd_hwdep(E) gpu_sched(E) drm_panel_backlight_quirks(E) cec(E) snd_pcm(E) drm_buddy(E) snd_seq_dummy(E) drm_ttm_helper(E) btusb(E) kvm(E) snd_seq_oss(E) btrtl(E) ttm(E) btintel(E) snd_seq_midi(E) btbcm(E) drm_exec(E) snd_seq_midi_event(E) i2c_algo_bit(E) snd_rawmidi(E) bluetooth(E) drm_suballoc_helper(E) irqbypass(E) snd_seq(E) ghash_clmulni_intel(E) sha512_ssse3(E) drm_display_helper(E) aesni_intel(E) snd_seq_device(E) rfkill(E) snd_timer(E) gf128mul(E) drm_client_lib(E) drm_kms_helper(E) snd(E) i2c_piix4(E) joydev(E) soundcore(E) wmi_bmof(E) ccp(E) k10temp(E) i2c_smbus(E) gpio_amdpt(E) i2c_designware_platform(E) gpio_generic(E) sg(E) [ 876.949914] i2c_designware_core(E) sch_fq_codel(E) parport_pc(E) drm(E) ppdev(E) lp(E) parport(E) fuse(E) nfnetlink(E) ip_tables(E) ext4 crc16 mbcache jbd2 sd_mod sfp mdio_i2c i2c_core txgbe ahci ngbe pcs_xpcs libahci libwx r8169 phylink libata realtek ptp pps_core video wmi [ 876.949933] CPU: 14 UID: 0 PID: 0 Comm: swapper/14 Kdump: loaded Tainted: G W E 6.16.0-rc2+ #20 PREEMPT(voluntary) [ 876.949935] Tainted: [W]=WARN, [E]=UNSIGNED_MODULE [ 876.949936] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024 [ 876.949936] RIP: 0010:__list_del_entry_valid_or_report+0x67/0x120 [ 876.949938] Code: 00 00 00 48 39 7d 08 0f 85 a6 00 00 00 5b b8 01 00 00 00 5d 41 5c e9 73 0d 93 ff 48 89 fe 48 c7 c7 a0 31 e8 89 e8 59 7c b3 ff <0f> 0b 31 c0 5b 5d 41 5c e9 57 0d 93 ff 48 89 fe 48 c7 c7 c8 31 e8 [ 876.949940] RSP: 0018:ffffaa73405d0c60 EFLAGS: 00010282 [ 876.949941] RAX: 0000000000000000 RBX: ffffead40445a348 RCX: 0000000000000000 [ 876.949942] RDX: 0000000000000105 RSI: 00000 ---truncated---
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于重复调用page_pool_put_full_page，可能导致双重释放。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 3c47e8ae113a68da47987750d9896e325d0aeedd ~ 3c91a56762b1f0d1e4af2d86c2cba83b61ed9eaa -
LinuxLinux 6.3 -

II. Public POCs for CVE-2025-38490

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-38490

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-07-28 · 29 CVEs total

CVE-2025-384889.8 CRITICALsmb: client: fix use-after-free in crypt_message when using async crypto
CVE-2025-384719.8 CRITICALtls: always refresh the queue when reading sock
CVE-2025-384729.8 CRITICALnetfilter: nf_conntrack: fix crash due to removal of uninitialised entry
CVE-2025-384769.8 CRITICALrpl: Fix use-after-free in rpl_do_srh_inline().
CVE-2025-384958.8 HIGHHID: core: ensure the allocated report buffer can contain the reserved report ID
CVE-2025-384918.2 HIGHmptcp: make fallback action and fallback decision atomic
CVE-2025-384787.8 HIGHcomedi: Fix initialization of data for instructions that write to subdevice
CVE-2025-384857.8 HIGHiio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
CVE-2025-384867.8 HIGHsoundwire: Revert "soundwire: qcom: Add set_channel_map api support"
CVE-2025-384847.8 HIGHiio: backend: fix out-of-bound write
CVE-2025-384947.8 HIGHHID: core: do not bypass hid_hw_raw_request
CVE-2025-384777.8 HIGHnet/sched: sch_qfq: Fix race condition on qfq_aggregate
CVE-2025-384757.8 HIGHsmc: Fix various oops due to inet_sock type confusion.
CVE-2025-384707.8 HIGHnet: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
CVE-2025-38483comedi: das16m1: Fix bit shift out of bounds
CVE-2025-38493tracing/osnoise: Fix crash in timerlat_dump_stack()
CVE-2025-38492netfs: Fix race between cache write completion and ALL_QUEUED being set
CVE-2025-38496dm-bufio: fix sched in atomic context
CVE-2025-38489s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
CVE-2025-38497usb: gadget: configfs: Fix OOB read on empty string write

Showing top 20 of 29 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-38490

No comments yet

Leave a comment