What’s Vulnerable › Vulnerabilities

CVE-2025-38270: net: drv: netdevsim: don't napi_complete() from netpoll

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-10 · updated 2026-10-15

Description

In the Linux kernel, the following vulnerability has been resolved: net: drv: netdevsim: don't napi_complete() from netpoll netdevsim supports netpoll. Make sure we don't call napi_complete() from it, since it may not be scheduled. Breno reports hitting a warning in napi_complete_done(): WARNING: CPU: 14 PID: 104 at net/core/dev.c:6592 napi_complete_done+0x2cc/0x560 __napi_poll+0x2d8/0x3a0 handle_softirqs+0x1fe/0x710 This is presumably after netpoll stole the SCHED bit prematurely.

Affected products

• Linux kernel: from 6.10 before 6.12.34; from 6.13 before 6.15.3; 6.16-rc1 — fixed in 6.12.34, 6.15.3

How to fix

Upgrade to a fixed version: Linux kernel 6.12.34, 6.15.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/1264971017b4d7141352a7fe29021bdfce5d885d
• https://git.kernel.org/stable/c/6837dd877270c57689bd866de9f3de14172c2439
• https://git.kernel.org/stable/c/a8ff2e362d901200a1075c3ca9c56d9c7bbef389

Get alerted when CVE-2025-38270 or the next vulnerability affects your stack