CVE-2025-38470

一、漏洞信息
 漏洞编号：[CVE-2025-38470](https://nvd.nist.gov/vuln/detail/CVE-2025-38470)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtimeAssuming the  rx-vlan-filter  feature is enabled on a net device, the8021q module will automatically add or remove VLAN 0 when the net deviceis put administratively up or down, respectively. There are a couple ofproblems with the above scheme.The first problem is a memory leak that can happen if the  rx-vlan-filter feature is disabled while the device is running: # ip link add bond1 up type bond mode 0 # ethtool -K bond1 rx-vlan-filter off # ip link del dev bond1When the device is put administratively down the  rx-vlan-filter feature is disabled, so the 8021q module will not remove VLAN 0 and thememory will be leaked [1].Another problem that can happen is that the kernel can automaticallydelete VLAN 0 when the device is put administratively down despite notadding it when the device was put administratively up since during thattime the  rx-vlan-filter  feature was disabled. null-ptr-unref orbug_on[2] will be triggered by unregister_vlan_dev() for refcountimbalance if toggling filtering during runtime:$ ip link add bond0 type bond mode 0$ ip link add link bond0 name vlan0 type vlan id 0 protocol 802.1q$ ethtool -K bond0 rx-vlan-filter off$ ifconfig bond0 up$ ethtool -K bond0 rx-vlan-filter on$ ifconfig bond0 down$ ip link del vlan0Root cause is as below:step1: add vlan0 for real_dev, such as bond, team.register_vlan_dev    vlan_vid_add(real_dev,htons(ETH_P_8021Q),0) //refcnt=1step2: disable vlan filter feature and enable real_devstep3: change filter from 0 to 1vlan_device_event    vlan_filter_push_vids        ndo_vlan_rx_add_vid //No refcnt added to real_dev vlan0step4: real_dev downvlan_device_event    vlan_vid_del(dev, htons(ETH_P_8021Q), 0); //refcnt=0        vlan_info_rcu_free //free vlan0step5: delete vlan0unregister_vlan_dev    BUG_ON(!vlan_info); //vlan_info is nullFix both problems by noting in the VLAN info whether VLAN 0 wasautomatically added upon NETDEV_UP and based on that decide whether itshould be deleted upon NETDEV_DOWN, regardless of the state of the rx-vlan-filter  feature.[1]unreferenced object 0xffff8880068e3100 (size 256):  comm  ip , pid 384, jiffies 4296130254  hex dump (first 32 bytes):    00 20 30 0d 80 88 ff ff 00 00 00 00 00 00 00 00  . 0.............    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................  backtrace (crc 81ce31fa):    __kmalloc_cache_noprof+0x2b5/0x340    vlan_vid_add+0x434/0x940    vlan_device_event.cold+0x75/0xa8    notifier_call_chain+0xca/0x150    __dev_notify_flags+0xe3/0x250    rtnl_configure_link+0x193/0x260    rtnl_newlink_create+0x383/0x8e0    __rtnl_newlink+0x22c/0xa40    rtnl_newlink+0x627/0xb00    rtnetlink_rcv_msg+0x6fb/0xb70    netlink_rcv_skb+0x11f/0x350    netlink_unicast+0x426/0x710    netlink_sendmsg+0x75a/0xc20    __sock_sendmsg+0xc1/0x150    ____sys_sendmsg+0x5aa/0x7b0    ___sys_sendmsg+0xfc/0x180[2]kernel BUG at net/8021q/vlan.c:99!Oops: invalid opcode: 0000 [#1] SMP KASAN PTICPU: 0 UID: 0 PID: 382 Comm: ip Not tainted 6.16.0-rc3 #61 PREEMPT(voluntary)Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014RIP: 0010:unregister_vlan_dev (net/8021q/vlan.c:99 (discriminator 1))RSP: 0018:ffff88810badf310 EFLAGS: 00010246RAX: 0000000000000000 RBX: ffff88810da84000 RCX: ffffffffb47ceb9aRDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88810e8b43c8RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6cefe80R10: ffffffffb677f407 R11: ffff88810badf3c0 R12: ffff88810e8b4000R13: 0000000000000000 R14: ffff88810642a5c0 R15: 000000000000017eFS:  00007f1ff68c20c0(0000) GS:ffff888163a24000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00007f1ff5dad240 CR3: 0000000107e56000 CR4: 00000000000006f0Call Trace: <TASK---truncated---
 漏洞公开时间：2025-07-28 20:15:28
 漏洞创建时间：2025-07-28 20:21:22
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-38470
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://git.kernel.org/stable/c/579d4f9ca9a9a605184a9b162355f6ba131f678d |  |
|  | https://git.kernel.org/stable/c/8984bcbd1edf5bee5be06ad771d157333b790c33 |  |
|  | https://git.kernel.org/stable/c/93715aa2d80e6c5cea1bb486321fc4585076928b |  |
|  | https://git.kernel.org/stable/c/bb515c41306454937464da055609b5fb0a27821b |  |
|  | https://git.kernel.org/stable/c/d43ef15bf4856c8c4c6c3572922331a5f06deb77 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025072811-CVE-2025-38470-a4d4@gregkh/T/#u |  |
|  | https://security-tracker.debian.org/tracker/CVE-2025-38470 |  |
|  | https://ubuntu.com/security/CVE-2025-38470 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2025-38470 |  |
|  | https://git.kernel.org/linus/579d4f9ca9a9a605184a9b162355f6ba131f678d |  |
|  | https://access.redhat.com/security/cve/cve-2025-38470 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://github.com/gregkh/linux/commit/579d4f9ca9a9a605184a9b162355f6ba131f678d.patch |  | ljqc |
|  |  | https://git.kernel.org/stable/c/579d4f9ca9a9a605184a9b162355f6ba131f678d |  | nvd |
|  |  | https://git.kernel.org/stable/c/8984bcbd1edf5bee5be06ad771d157333b790c33 |  | nvd |
|  |  | https://git.kernel.org/stable/c/93715aa2d80e6c5cea1bb486321fc4585076928b |  | nvd |
|  |  | https://git.kernel.org/stable/c/bb515c41306454937464da055609b5fb0a27821b |  | nvd |
|  |  | https://git.kernel.org/stable/c/d43ef15bf4856c8c4c6c3572922331a5f06deb77 |  | nvd |
|  |  | https://git.kernel.org/linus/579d4f9ca9a9a605184a9b162355f6ba131f678d |  | osv |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtimeAssuming the &#34;rx-vlan-filter&#34; feature is enabled on a net device, the8021q module will automatically add or remove VLAN 0 when the net deviceis put administratively up or down, respectively. There are a couple ofproblems with the above scheme.The first problem is a memory leak that can happen if the &#34;rx-vlan-filter&#34;feature is disabled while the device is running: # ip link add bond1 up type bond mode 0 # ethtool -K bond1 rx-vlan-filter off # ip link del dev bond1When the device is put administratively down the &#34;rx-vlan-filter&#34;feature is disabled, so the 8021q module will not remove VLAN 0 and thememory will be leaked [1].Another problem that can happen is that the kernel can automaticallydelete VLAN 0 when the device is put administratively down despite notadding it when the device was put administratively up since during thattime the &#34;rx-vlan-filter&#34; feature was disabled. null-ptr-unref orbug_on[2] will be triggered by unregister_vlan_dev() for refcountimbalance if toggling filtering during runtime:$ ip link add bond0 type bond mode 0$ ip link add link bond0 name vlan0 type vlan id 0 protocol 802.1q$ ethtool -K bond0 rx-vlan-filter off$ ifconfig bond0 up$ ethtool -K bond0 rx-vlan-filter on$ ifconfig bond0 down$ ip link del vlan0Root cause is as below:step1: add vlan0 for real_dev, such as bond, team.register_vlan_dev    vlan_vid_add(real_dev,htons(ETH_P_8021Q),0) //refcnt=1step2: disable vlan filter feature and enable real_devstep3: change filter from 0 to 1vlan_device_event    vlan_filter_push_vids        ndo_vlan_rx_add_vid //No refcnt added to real_dev vlan0step4: real_dev downvlan_device_event    vlan_vid_del(dev, htons(ETH_P_8021Q), 0); //refcnt=0        vlan_info_rcu_free //free vlan0step5: delete vlan0unregister_vlan_dev    BUG_ON(!vlan_info); //vlan_info is nullFix both problems by noting in the VLAN info whether VLAN 0 wasautomatically added upon NETDEV_UP and based on that decide whether itshould be deleted upon NETDEV_DOWN, regardless of the state of the&#34;rx-vlan-filter&#34; feature.[1]unreferenced object 0xffff8880068e3100 (size 256):  comm &#34;ip&#34;, pid 384, jiffies 4296130254  hex dump (first 32 bytes):    00 20 30 0d 80 88 ff ff 00 00 00 00 00 00 00 00  . 0.............    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................  backtrace (crc 81ce31fa):    __kmalloc_cache_noprof+0x2b5/0x340    vlan_vid_add+0x434/0x940    vlan_device_event.cold+0x75/0xa8    notifier_call_chain+0xca/0x150    __dev_notify_flags+0xe3/0x250    rtnl_configure_link+0x193/0x260    rtnl_newlink_create+0x383/0x8e0    __rtnl_newlink+0x22c/0xa40    rtnl_newlink+0x627/0xb00    rtnetlink_rcv_msg+0x6fb/0xb70    netlink_rcv_skb+0x11f/0x350    netlink_unicast+0x426/0x710    netlink_sendmsg+0x75a/0xc20    __sock_sendmsg+0xc1/0x150    ____sys_sendmsg+0x5aa/0x7b0    ___sys_sendmsg+0xfc/0x180[2]kernel BUG at net/8021q/vlan.c:99!Oops: invalid opcode: 0000 [#1] SMP KASAN PTICPU: 0 UID: 0 PID: 382 Comm: ip Not tainted 6.16.0-rc3 #61 PREEMPT(voluntary)Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014RIP: 0010:unregister_vlan_dev (net/8021q/vlan.c:99 (discriminator 1))RSP: 0018:ffff88810badf310 EFLAGS: 00010246RAX: 0000000000000000 RBX: ffff88810da84000 RCX: ffffffffb47ceb9aRDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88810e8b43c8RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6cefe80R10: ffffffffb677f407 R11: ffff88810badf3c0 R12: ffff88810e8b4000R13: 0000000000000000 R14: ffff88810642a5c0 R15: 000000000000017eFS:  00007f1ff68c20c0(0000) GS:ffff888163a24000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00007f1ff5dad240 CR3: 0000000107e56000 CR4: 00000000000006f0Call Trace: &lt;TASK&gt;rtnl_dellink (net/core/rtnetlink.c:3511 net/core/rtnetlink.c:3553)rtnetlink_rcv_msg (net/core/rtnetlink.c:6945)netlink_rcv_skb (net/netlink/af_netlink.c:2535
 openEuler评分：
  3.9
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.openEuler-24.03-LTS-SP2(6.6.0):受影响
7.master(6.12.33):不受影响
8.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.openEuler-22.03-LTS-SP3(5.10.0):正常修复
3.openEuler-22.03-LTS-SP4(5.10.0):正常修复
4.openEuler-24.03-LTS(6.6.0):正常修复
5.openEuler-24.03-LTS-SP1(6.6.0):正常修复
6.openEuler-24.03-LTS-SP2(6.6.0):正常修复
7.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

@yangyingliang ,@jiaoff ,@guohaocs2c ,@hanjun-guo ,@woqidaideshi ,@newbeats ,@zhangyi089 ,@colyli ,@thundertown ,@htforge ,@chiqijun ,@lengchao ,@zhujianwei001 ,@kylin-mayukun ,@wangxiongfeng ,@wkfxxx ,@SuperSix173 ,@jentlestea ,@gasonchen ,@kailiu42 
**issue处理注意事项:** 
**1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;**
**2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;**
**3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, openEuler评分, 受影响版本排查(受影响/不受影响), 修复是否涉及abi变化(是/否), 原因说明)不能省略,省略后cve-manager将无法正常解析填写内容.**
************************************************************************
影响性分析说明:

openEuler评分: (评分和向量)

受影响版本排查(受影响/不受影响): 
1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):
8.openEuler-24.03-LTS-SP2(6.6.0):

修复是否涉及abi变化(是/否)：
1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):
8.openEuler-24.03-LTS-SP2(6.6.0):

原因说明：
1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):
8.openEuler-24.03-LTS-SP2(6.6.0):

issue处理具体操作请参考: 
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
pr关联issue具体操作请参考:
https://gitee.com/help/articles/4142

<table><tr><th white-space: nowrap;>参考网址</th> <th white-space: nowrap;>关联pr</th> <th white-space: nowrap;>状态</th> <th white-space: nowrap;>补丁链接</th></tr><tr><td rowspan="1">https://nvd.nist.gov/vuln/detail/CVE-2025-38470</td><td>None</td><td>None</td><td><a href=https://git.kernel.org/stable/c/8984bcbd1edf5bee5be06ad771d157333b790c33>https://git.kernel.org/stable/c/8984bcbd1edf5bee5be06ad771d157333b790c33</a><br /><a href=https://git.kernel.org/stable/c/bb515c41306454937464da055609b5fb0a27821b>https://git.kernel.org/stable/c/bb515c41306454937464da055609b5fb0a27821b</a><br /><a href=https://git.kernel.org/stable/c/d43ef15bf4856c8c4c6c3572922331a5f06deb77>https://git.kernel.org/stable/c/d43ef15bf4856c8c4c6c3572922331a5f06deb77</a><br /><a href=https://git.kernel.org/stable/c/93715aa2d80e6c5cea1bb486321fc4585076928b>https://git.kernel.org/stable/c/93715aa2d80e6c5cea1bb486321fc4585076928b</a><br /><a href=https://git.kernel.org/stable/c/579d4f9ca9a9a605184a9b162355f6ba131f678d>https://git.kernel.org/stable/c/579d4f9ca9a9a605184a9b162355f6ba131f678d</a></td></tr><tr><td rowspan="1">https://ubuntu.com/security/CVE-2025-38470</td><td>None</td><td>None</td><td><a href=https://discourse.ubuntu.com/c/project>https://discourse.ubuntu.com/c/project</a></td></tr><tr><td rowspan="1">https://www.opencve.io/cve/CVE-2025-38470</td><td>None</td><td>None</td><td><a href=https://git.kernel.org/stable/c/8984bcbd1edf5bee5be06ad771d157333b790c33>https://git.kernel.org/stable/c/8984bcbd1edf5bee5be06ad771d157333b790c33</a><br /><a href=https://git.kernel.org/stable/c/bb515c41306454937464da055609b5fb0a27821b>https://git.kernel.org/stable/c/bb515c41306454937464da055609b5fb0a27821b</a><br /><a href=https://git.kernel.org/stable/c/d43ef15bf4856c8c4c6c3572922331a5f06deb77>https://git.kernel.org/stable/c/d43ef15bf4856c8c4c6c3572922331a5f06deb77</a><br /><a href=https://git.kernel.org/stable/c/93715aa2d80e6c5cea1bb486321fc4585076928b>https://git.kernel.org/stable/c/93715aa2d80e6c5cea1bb486321fc4585076928b</a><br /><a href=https://git.kernel.org/stable/c/579d4f9ca9a9a605184a9b162355f6ba131f678d>https://git.kernel.org/stable/c/579d4f9ca9a9a605184a9b162355f6ba131f678d</a></td></tr><tr><td>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2025-38470</td><td></td><td></td><td></td></tr><tr><td>https://security-tracker.debian.org/tracker/CVE-2025-38470</td><td></td><td></td><td></td></tr><tr><td>http://www.cnnvd.org.cn/web/vulnerability/queryLds.tag?qcvCnnvdid=CVE-2025-38470</td><td></td><td></td><td></td></tr></table>

> 说明：补丁链接仅供初步排查参考，实际可用性请人工再次确认，补丁下载验证可使用[CVE补丁工具](https://gitee.com/openeuler/cve-manager/blob/master/cve-agency-manager/cve_tracking/README.md)。
若补丁不准确，烦请在此issue下评论 '/report-patch 参考网址 补丁链接1,补丁链接2' 反馈正确信息，便于我们不断优化工具，不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1

CVE-2025-38470

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime

Assuming the &#34;rx-vlan-filter&#34; feature is enabled on a net device, the
8021q module will automatically add or remove VLAN 0 when the net device
is put administratively up or down, respectively. There are a couple of
problems with the above scheme.

The first problem is a memory leak that can happen if the &#34;rx-vlan-filter&#34;
feature is disabled while the device is running:

# ip link add bond1 up type bond mode 0
 # ethtool -K bond1 rx-vlan-filter off
 # ip link del dev bond1

When the device is put administratively down the &#34;rx-vlan-filter&#34;
feature is disabled, so the 8021q module will not remove VLAN 0 and the
memory will be leaked [1].

Another problem that can happen is that the kernel can automatically
delete VLAN 0 when the device is put administratively down despite not
adding it when the device was put administratively up since during that
time the &#34;rx-vlan-filter&#34; feature was disabled. null-ptr-unref or
bug_on[2] will be triggered by unregister_vlan_dev() for refcount
imbalance if toggling filtering during runtime:

$ ip link add bond0 type bond mode 0
$ ip link add link bond0 name vlan0 type vlan id 0 protocol 802.1q
$ ethtool -K bond0 rx-vlan-filter off
$ ifconfig bond0 up
$ ethtool -K bond0 rx-vlan-filter on
$ ifconfig bond0 down
$ ip link del vlan0

Root cause is as below:
step1: add vlan0 for real_dev, such as bond, team.
register_vlan_dev
    vlan_vid_add(real_dev,htons(ETH_P_8021Q),0) //refcnt=1
step2: disable vlan filter feature and enable real_dev
step3: change filter from 0 to 1
vlan_device_event
    vlan_filter_push_vids
        ndo_vlan_rx_add_vid //No refcnt added to real_dev vlan0
step4: real_dev down
vlan_device_event
    vlan_vid_del(dev, htons(ETH_P_8021Q), 0); //refcnt=0
        vlan_info_rcu_free //free vlan0
step5: delete vlan0
unregister_vlan_dev
    BUG_ON(!vlan_info); //vlan_info is null

Fix both problems by noting in the VLAN info whether VLAN 0 was
automatically added upon NETDEV_UP and based on that decide whether it
should be deleted upon NETDEV_DOWN, regardless of the state of the
&#34;rx-vlan-filter&#34; feature.

[1]
unreferenced object 0xffff8880068e3100 (size 256):
  comm &#34;ip&#34;, pid 384, jiffies 4296130254
  hex dump (first 32 bytes):
    00 20 30 0d 80 88 ff ff 00 00 00 00 00 00 00 00  . 0.............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 81ce31fa):
    __kmalloc_cache_noprof+0x2b5/0x340
    vlan_vid_add+0x434/0x940
    vlan_device_event.cold+0x75/0xa8
    notifier_call_chain+0xca/0x150
    __dev_notify_flags+0xe3/0x250
    rtnl_configure_link+0x193/0x260
    rtnl_newlink_create+0x383/0x8e0
    __rtnl_newlink+0x22c/0xa40
    rtnl_newlink+0x627/0xb00
    rtnetlink_rcv_msg+0x6fb/0xb70
    netlink_rcv_skb+0x11f/0x350
    netlink_unicast+0x426/0x710
    netlink_sendmsg+0x75a/0xc20
    __sock_sendmsg+0xc1/0x150
    ____sys_sendmsg+0x5aa/0x7b0
    ___sys_sendmsg+0xfc/0x180

[2]
kernel BUG at net/8021q/vlan.c:99!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 382 Comm: ip Not tainted 6.16.0-rc3 #61 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:unregister_vlan_dev (net/8021q/vlan.c:99 (discriminator 1))
RSP: 0018:ffff88810badf310 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88810da84000 RCX: ffffffffb47ceb9a
RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88810e8b43c8
RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6cefe80
R10: ffffffffb677f407 R11: ffff88810badf3c0 R12: ffff88810e8b4000
R13: 0000000000000000 R14: ffff88810642a5c0 R15: 000000000000017e
FS:  00007f1ff68c20c0(0000) GS:ffff888163a24000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1ff5dad240 CR3: 0000000107e56000 CR4: 00000000000006f0
Call Trace:
 &lt;TASK&gt;
rtnl_dellink (net/core/rtnetlink.c:3511 net/core/rtnetlink.c:3553)
rtnetlink_rcv_msg (net/core/rtnetlink.c:6945)
netlink_rcv_skb (net/netlink/af_netlink.c:2535)
netlink_unicast (net/netlink/af_netlink.c:1314 net/netlink/af_netlink.c:1339)
netlink_sendmsg (net/netlink/af_netlink.c:1883)
____sys_sendmsg (net/socket.c:712 net/socket.c:727 net/socket.c:2566)
___sys_sendmsg (net/socket.c:2622)
__sys_sendmsg (net/socket.c:2652)
do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)

The Linux kernel CVE team has assigned CVE-2025-38470 to this issue.

openEuler评分:(评分和向量)
3.9
AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

受影响版本排查(受影响/不受影响):
1.master(6.1.0):不受影响
2.openEuler-20.03-LTS-SP4:受影响
3.openEuler-22.03-LTS-SP3:受影响
4.openEuler-22.03-LTS-SP4:受影响
5.openEuler-24.03-LTS:受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-24.03-LTS-SP1:受影响
8.openEuler-24.03-LTS-SP2:受影响

修复是否涉及abi变化(是/否)：
1.master(6.1.0):否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP3:否
4.openEuler-22.03-LTS-SP4:否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-SP2:否

原因说明：
1.master(23.08.5):不受影响-漏洞代码不能被攻击者触发
2.openEuler-20.03-LTS-SP4:正常修复
3.openEuler-22.03-LTS-SP3:正常修复
4.openEuler-22.03-LTS-SP4:正常修复
5.openEuler-24.03-LTS:正常修复
6.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1:正常修复
8.openEuler-24.03-LTS-SP2:正常修复

@CTC-XiboWang 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态  | 分析项目 | 内容 |
|:--:|:--:|---------|
|已分析|1.影响性分析说明|In the Linux kernel, the following vulnerability has been resolved:net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtimeAssuming the &#34;rx-vlan-filter&#34; feature is enabled on a net device, the8021q module will automatically add or remove VLAN 0 when the net deviceis put administratively up or down, respectively. There are a couple ofproblems with the above scheme.The first problem is a memory leak that can happen if the &#34;rx-vlan-filter&#34;feature is disabled while the device is running: # ip link add bond1 up type bond mode 0 # ethtool -K bond1 rx-vlan-filter off # ip link del dev bond1When the device is put administratively down the &#34;rx-vlan-filter&#34;feature is disabled, so the 8021q module will not remove VLAN 0 and thememory will be leaked [1].Another problem that can happen is that the kernel can automaticallydelete VLAN 0 when the device is put administratively down despite notadding it when the device was put administratively up since during thattime the &#34;rx-vlan-filter&#34; feature was disabled. null-ptr-unref orbug_on[2] will be triggered by unregister_vlan_dev() for refcountimbalance if toggling filtering during runtime:$ ip link add bond0 type bond mode 0$ ip link add link bond0 name vlan0 type vlan id 0 protocol 802.1q$ ethtool -K bond0 rx-vlan-filter off$ ifconfig bond0 up$ ethtool -K bond0 rx-vlan-filter on$ ifconfig bond0 down$ ip link del vlan0Root cause is as below:step1: add vlan0 for real_dev, such as bond, team.register_vlan_dev    vlan_vid_add(real_dev,htons(ETH_P_8021Q),0) //refcnt=1step2: disable vlan filter feature and enable real_devstep3: change filter from 0 to 1vlan_device_event    vlan_filter_push_vids        ndo_vlan_rx_add_vid //No refcnt added to real_dev vlan0step4: real_dev downvlan_device_event    vlan_vid_del(dev, htons(ETH_P_8021Q), 0); //refcnt=0        vlan_info_rcu_free //free vlan0step5: delete vlan0unregister_vlan_dev    BUG_ON(!vlan_info); //vlan_info is nullFix both problems by noting in the VLAN info whether VLAN 0 wasautomatically added upon NETDEV_UP and based on that decide whether itshould be deleted upon NETDEV_DOWN, regardless of the state of the&#34;rx-vlan-filter&#34; feature.[1]unreferenced object 0xffff8880068e3100 (size 256):  comm &#34;ip&#34;, pid 384, jiffies 4296130254  hex dump (first 32 bytes):    00 20 30 0d 80 88 ff ff 00 00 00 00 00 00 00 00  . 0.............    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................  backtrace (crc 81ce31fa):    __kmalloc_cache_noprof+0x2b5/0x340    vlan_vid_add+0x434/0x940    vlan_device_event.cold+0x75/0xa8    notifier_call_chain+0xca/0x150    __dev_notify_flags+0xe3/0x250    rtnl_configure_link+0x193/0x260    rtnl_newlink_create+0x383/0x8e0    __rtnl_newlink+0x22c/0xa40    rtnl_newlink+0x627/0xb00    rtnetlink_rcv_msg+0x6fb/0xb70    netlink_rcv_skb+0x11f/0x350    netlink_unicast+0x426/0x710    netlink_sendmsg+0x75a/0xc20    __sock_sendmsg+0xc1/0x150    ____sys_sendmsg+0x5aa/0x7b0    ___sys_sendmsg+0xfc/0x180[2]kernel BUG at net/8021q/vlan.c:99!Oops: invalid opcode: 0000 [#1] SMP KASAN PTICPU: 0 UID: 0 PID: 382 Comm: ip Not tainted 6.16.0-rc3 #61 PREEMPT(voluntary)Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014RIP: 0010:unregister_vlan_dev (net/8021q/vlan.c:99 (discriminator 1))RSP: 0018:ffff88810badf310 EFLAGS: 00010246RAX: 0000000000000000 RBX: ffff88810da84000 RCX: ffffffffb47ceb9aRDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88810e8b43c8RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6cefe80R10: ffffffffb677f407 R11: ffff88810badf3c0 R12: ffff88810e8b4000R13: 0000000000000000 R14: ffff88810642a5c0 R15: 000000000000017eFS:  00007f1ff68c20c0(0000) GS:ffff888163a24000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00007f1ff5dad240 CR3: 0000000107e56000 CR4: 00000000000006f0Call Trace: &lt;TASK&gt;rtnl_dellink (net/core/rtnetlink.c:3511 net/core/rtnetlink.c:3553)rtnetlink_rcv_msg (net/core/rtnetlink.c:6945)netlink_rcv_skb (net/netlink/af_netlink.c:2535)netlink_unicast (net/netlink/af_netlink.c:1314 net/netlink/af_netlink.c:1339)netlink_sendmsg (net/netlink/af_netlink.c:1883)____sys_sendmsg (net/socket.c:712 net/socket.c:727 net/socket.c:2566)___sys_sendmsg (net/socket.c:2622)__sys_sendmsg (net/socket.c:2652)do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)The Linux kernel CVE team has assigned CVE-2025-38470 to this issue.|
|已分析|2.openEulerScore|3.9|
|已分析|3.openEulerVector|AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L|
|已分析|4.受影响版本排查|openEuler-20.03-LTS-SP4:受影响,openEuler-22.03-LTS-SP3:受影响,openEuler-22.03-LTS-SP4:受影响,openEuler-24.03-LTS:受影响,openEuler-24.03-LTS-SP1:受影响,openEuler-24.03-LTS-SP2:受影响,master:不受影响,openEuler-24.03-LTS-Next:不受影响|
|已分析|5.是否涉及abi变化|master:否,openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP3:否,openEuler-22.03-LTS-SP4:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-24.03-LTS-SP1:否,openEuler-24.03-LTS-SP2:否|
|已分析|6.原因说明|openEuler-20.03-LTS-SP4:正常修复,openEuler-22.03-LTS-SP3:正常修复,openEuler-22.03-LTS-SP4:正常修复,openEuler-24.03-LTS:正常修复,openEuler-24.03-LTS-SP1:正常修复,openEuler-24.03-LTS-SP2:正常修复,master:不受影响-漏洞代码不能被攻击者触发,openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发|

**请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.**

src-openEuler/kernel

内容风险标识

评论 (5)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-38470

评论 (5)

搜索帮助

src-openEuler/kernel