CVE-2025-38490
A double‑free bug in the Linux kernel’s networking code can crash the system, causing a kernel panic. The flaw occurs when a page is freed twice, corrupting memory structures. It can be triggered by normal network traffic without any special privileges.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel 6.16 and earlier versions. System administrators running these kernels are at risk.
Real-world impact
An attacker can cause the kernel to crash, leading to a denial‑of‑service that requires a reboot. The crash can also expose the system to further exploitation if the kernel is restarted with compromised state.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability gives an attacker full control over confidentiality, integrity, and availability of the system, requires no privileges or user interaction, and can be exploited remotely.
What to do about it
- 01Upgrade the Linux kernel to version 6.16 or later, which contains the patch that removes the duplicate page_pool_put_full_page() call.
- 02Reboot the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Jul 28, 2025 · Jul 28, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.