CVE-2025-38708

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38708", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.033Z", "datePublished": "2025-09-04T15:32:59.108Z", "dateUpdated": "2026-10-15T01:07:44.390Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:04:09.433Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrbd: add missing kref_get in handle_write_conflicts\n\nWith `two-primaries` enabled, DRBD tries to detect \"concurrent\" writes\nand handle write conflicts, so that even if you write to the same sector\nsimultaneously on both nodes, they end up with the identical data once\nthe writes are completed.\n\nIn handling \"superseeded\" writes, we forgot a kref_get,\nresulting in a premature drbd_destroy_device and use after free,\nand further to kernel crashes with symptoms.\n\nRelevance: No one should use DRBD as a random data generator, and apparently\nall users of \"two-primaries\" handle concurrent writes correctly on layer up.\nThat is cluster file systems use some distributed lock manager,\nand live migration in virtualization environments stops writes on one node\nbefore starting writes on the other node.\n\nWhich means that other than for \"test cases\",\nthis code path is never taken in real life.\n\nFYI, in DRBD 9, things are handled differently nowadays. We still detect\n\"write conflicts\", but no longer try to be smart about them.\nWe decided to disconnect hard instead: upper layers must not submit concurrent\nwrites. If they do, that's their fault."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is the DRBD receiver thread processing P_DATA replication packets arriving over TCP from a remote peer, with the conflicting sector and size taken directly from the wire (`be64_to_cpu(p->sector)`). The DRBD replication port is a routable TCP listener, so this is remotely reachable.\nAC:L - The attacker controls the sector, size, and rate of the conflicting writes and can retry indefinitely at no cost against a dual-primary node that is by definition writing continuously, so the required overlap window is forced by volume rather than won by luck. Only a handful of hits are needed to drive `device->kref` to zero, and the maintainer's \"never taken in real life\" note concerns well-behaved upper layers, not a peer deliberately submitting concurrent writes.\nPR:N - DRBD peer authentication is entirely optional \u2014 `conn_connect()` only calls `drbd_do_auth()` when `cram_hmac_tfm` is set, which is unconfigured by default \u2014 and the accept path performs no source-address validation, so any host that can reach the port completes the handshake and becomes the peer. Even with a shared secret, a malicious peer node holds no privilege on the target kernel.\nUI:N - Exploitation requires nothing from a local user beyond the cluster running its normal dual-primary workload; the attacker connects and sends conflicting writes entirely on their own initiative.\nS:U - The refcount underflow and resulting use-after-free are confined to the target kernel's own memory and security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The premature `drbd_destroy_device()` frees `struct drbd_device` and all `peer_device` objects while the receiver thread and block layer keep dereferencing them, and the attacker supplies a continuous stream of arbitrary replicated block data that reclaims the freed slab slots with controlled contents. The driver then reads through dangling pointers and sends acks back over the network, yielding an arbitrary kernel-memory read primitive.\nI:H - A use-after-free on a heap object containing embedded `work_struct`, `timer_list`, and gendisk/queue function pointers, combined with the attacker's controlled heap-spray via replicated write data, gives a write and control-flow-hijack primitive. Separately, tearing down the block device under a live mounted filesystem destroys stored data integrity.\nA:H - The commit states the missing `kref_get` leads to \"premature drbd_destroy_device and use after free, and further to kernel crashes.\" Destroying the device also `put_disk()`s the gendisk and destroys workqueues under an active filesystem, panicking the node and taking down the replicated storage."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/block/drbd/drbd_receiver.c"], "versions": [{"version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "lessThan": "0336bfe9c237476bd7c45605a36ca79c2bca62e5", "status": "affected", "versionType": "git"}, {"version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "lessThan": "810cd546a29bfac90ed1328ea01d693d4bd11cb1", "status": "affected", "versionType": "git"}, {"version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "lessThan": "84ef8dd3238330d1795745ece83b19f0295751bf", "status": "affected", "versionType": "git"}, {"version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "lessThan": "57418de35420cedab035aa1da8a26c0499b7f575", "status": "affected", "versionType": "git"}, {"version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "lessThan": "9f53b2433ad248cd3342cc345f56f5c7904bd8c4", "status": "affected", "versionType": "git"}, {"version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "lessThan": "7d483ad300fc0a06f69b019dda8f74970714baf8", "status": "affected", "versionType": "git"}, {"version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "lessThan": "46e3763dcae0ffcf8fcfaff4fc10a90a92ffdd89", "status": "affected", "versionType": "git"}, {"version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "lessThan": "3a896498f6f577e57bf26aaa93b48c22b6d20c20", "status": "affected", "versionType": "git"}, {"version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "lessThan": "00c9c9628b49e368d140cfa61d7df9b8922ec2a8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/block/drbd/drbd_receiver.c"], "versions": [{"version": "4.5", "status": "affected"}, {"version": "0", "lessThan": "4.5", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.297", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.241", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.190", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.149", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.103", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.43", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.11", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.2", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "5.4.297"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "5.10.241"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "5.15.190"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.1.149"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.6.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.12.43"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.15.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.16.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0336bfe9c237476bd7c45605a36ca79c2bca62e5"}, {"url": "https://git.kernel.org/stable/c/810cd546a29bfac90ed1328ea01d693d4bd11cb1"}, {"url": "https://git.kernel.org/stable/c/84ef8dd3238330d1795745ece83b19f0295751bf"}, {"url": "https://git.kernel.org/stable/c/57418de35420cedab035aa1da8a26c0499b7f575"}, {"url": "https://git.kernel.org/stable/c/9f53b2433ad248cd3342cc345f56f5c7904bd8c4"}, {"url": "https://git.kernel.org/stable/c/7d483ad300fc0a06f69b019dda8f74970714baf8"}, {"url": "https://git.kernel.org/stable/c/46e3763dcae0ffcf8fcfaff4fc10a90a92ffdd89"}, {"url": "https://git.kernel.org/stable/c/3a896498f6f577e57bf26aaa93b48c22b6d20c20"}, {"url": "https://git.kernel.org/stable/c/00c9c9628b49e368d140cfa61d7df9b8922ec2a8"}], "title": "drbd: add missing kref_get in handle_write_conflicts", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:41:39.261Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:07:44.390Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [{"status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}]}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/block/drbd/drbd_receiver.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0336bfe9c237476bd7c45605a36ca79c2bca62e5", "status": "affected", "version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "versionType": "git"}, {"lessThan": "810cd546a29bfac90ed1328ea01d693d4bd11cb1", "status": "affected", "version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "versionType": "git"}, {"lessThan": "84ef8dd3238330d1795745ece83b19f0295751bf", "status": "affected", "version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "versionType": "git"}, {"lessThan": "57418de35420cedab035aa1da8a26c0499b7f575", "status": "affected", "version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "versionType": "git"}, {"lessThan": "9f53b2433ad248cd3342cc345f56f5c7904bd8c4", "status": "affected", "version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "versionType": "git"}, {"lessThan": "7d483ad300fc0a06f69b019dda8f74970714baf8", "status": "affected", "version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "versionType": "git"}, {"lessThan": "46e3763dcae0ffcf8fcfaff4fc10a90a92ffdd89", "status": "affected", "version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "versionType": "git"}, {"lessThan": "3a896498f6f577e57bf26aaa93b48c22b6d20c20", "status": "affected", "version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "versionType": "git"}, {"lessThan": "00c9c9628b49e368d140cfa61d7df9b8922ec2a8", "status": "affected", "version": "668700b40a7c8727bbd2b3fd4fd22e0ce3f1aeb6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/block/drbd/drbd_receiver.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.5"}, {"lessThan": "4.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.297", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.241", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.190", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.149", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.103", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.43", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.11", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC CN 4100", "vendor": "Siemens", "versions": [{"lessThan": "V5.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0936A224-7132-4A97-AF38-F747AC90F7F7", "versionEndExcluding": "5.4.297", "versionStartIncluding": "4.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0D21C35-EB8A-488A-BBF9-403E4817E5DD", "versionEndExcluding": "5.10.241", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD9E597F-3DDE-4D7E-976C-463D0611F13F", "versionEndExcluding": "5.15.190", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FDBE8280-8983-4D2D-943D-2E6D0104E2D8", "versionEndExcluding": "6.1.149", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F2293654-7169-49B5-8D0D-EE51EF8B8E48", "versionEndExcluding": "6.6.103", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "472C5F87-2BF3-4FAB-9B21-DA7513977363", "versionEndExcluding": "6.12.43", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC242347-F722-43AE-B910-BE0B22386977", "versionEndExcluding": "6.15.11", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD7C087D-2415-4521-B624-30003352F899", "versionEndExcluding": "6.16.2", "versionStartIncluding": "6.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrbd: add missing kref_get in handle_write_conflicts\n\nWith `two-primaries` enabled, DRBD tries to detect \"concurrent\" writes\nand handle write conflicts, so that even if you write to the same sector\nsimultaneously on both nodes, they end up with the identical data once\nthe writes are completed.\n\nIn handling \"superseeded\" writes, we forgot a kref_get,\nresulting in a premature drbd_destroy_device and use after free,\nand further to kernel crashes with symptoms.\n\nRelevance: No one should use DRBD as a random data generator, and apparently\nall users of \"two-primaries\" handle concurrent writes correctly on layer up.\nThat is cluster file systems use some distributed lock manager,\nand live migration in virtualization environments stops writes on one node\nbefore starting writes on the other node.\n\nWhich means that other than for \"test cases\",\nthis code path is never taken in real life.\n\nFYI, in DRBD 9, things are handled differently nowadays. We still detect\n\"write conflicts\", but no longer try to be smart about them.\nWe decided to disconnect hard instead: upper layers must not submit concurrent\nwrites. If they do, that's their fault."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrbd: a\u00f1adir kref_get faltante en handle_write_conflicts\n\nCon 'two-primaries' habilitado, DRBD intenta detectar escrituras 'concurrentes' y manejar conflictos de escritura, de modo que incluso si se escribe en el mismo sector simult\u00e1neamente en ambos nodos, terminan con los datos id\u00e9nticos una vez que las escrituras se completan.\n\nAl manejar escrituras 'superpuestas', olvidamos un kref_get, lo que result\u00f3 en un drbd_destroy_device prematuro y uso despu\u00e9s de liberar, y adem\u00e1s en fallos del kernel con s\u00edntomas.\n\nRelevancia: Nadie deber\u00eda usar DRBD como un generador de datos aleatorios, y aparentemente todos los usuarios de 'two-primaries' manejan las escrituras concurrentes correctamente en la capa superior. Es decir, los sistemas de archivos en cl\u00faster usan alg\u00fan gestor de bloqueo distribuido, y la migraci\u00f3n en vivo en entornos de virtualizaci\u00f3n detiene las escrituras en un nodo antes de iniciar escrituras en el otro nodo.\n\nLo que significa que, aparte de para 'casos de prueba', esta ruta de c\u00f3digo nunca se toma en la vida real.\n\nPara su informaci\u00f3n, en DRBD 9, las cosas se manejan de manera diferente hoy en d\u00eda. Todav\u00eda detectamos 'conflictos de escritura', pero ya no intentamos ser inteligentes al respecto. Decidimos desconectar de forma contundente en su lugar: las capas superiores no deben enviar escrituras concurrentes. Si lo hacen, es su culpa."}], "id": "CVE-2025-38708", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-09-04T16:15:39.847", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/00c9c9628b49e368d140cfa61d7df9b8922ec2a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0336bfe9c237476bd7c45605a36ca79c2bca62e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3a896498f6f577e57bf26aaa93b48c22b6d20c20"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/46e3763dcae0ffcf8fcfaff4fc10a90a92ffdd89"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/57418de35420cedab035aa1da8a26c0499b7f575"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7d483ad300fc0a06f69b019dda8f74970714baf8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/810cd546a29bfac90ed1328ea01d693d4bd11cb1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/84ef8dd3238330d1795745ece83b19f0295751bf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9f53b2433ad248cd3342cc345f56f5c7904bd8c4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "drbd: add missing kref_get in handle_write_conflicts", "id": "2393208", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2393208"}, "csaw": false, "details": ["No description is available for this CVE."], "name": "CVE-2025-38708", "public_date": "2025-09-04T15:32:59Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38708\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38708\nhttps://git.kernel.org/stable/c/00c9c9628b49e368d140cfa61d7df9b8922ec2a8\nhttps://git.kernel.org/stable/c/0336bfe9c237476bd7c45605a36ca79c2bca62e5\nhttps://git.kernel.org/stable/c/3a896498f6f577e57bf26aaa93b48c22b6d20c20\nhttps://git.kernel.org/stable/c/46e3763dcae0ffcf8fcfaff4fc10a90a92ffdd89\nhttps://git.kernel.org/stable/c/57418de35420cedab035aa1da8a26c0499b7f575\nhttps://git.kernel.org/stable/c/7d483ad300fc0a06f69b019dda8f74970714baf8\nhttps://git.kernel.org/stable/c/810cd546a29bfac90ed1328ea01d693d4bd11cb1\nhttps://git.kernel.org/stable/c/84ef8dd3238330d1795745ece83b19f0295751bf\nhttps://git.kernel.org/stable/c/9f53b2433ad248cd3342cc345f56f5c7904bd8c4"]}

{"created": "2025-09-05T14:02:32.572957+00:00", "updated": "2025-09-05T14:02:32.573047+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}