CVE-2025-38470

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime

Assuming the "rx-vlan-filter" feature is enabled on a net device, the

8021q module will automatically add or remove VLAN 0 when the net device

is put administratively up or down, respectively. There are a couple of

problems with the above scheme.

The first problem is a memory leak that can happen if the "rx-vlan-filter"

feature is disabled while the device is running:

# ip link add bond1 up type bond mode 0

# ethtool -K bond1 rx-vlan-filter off

# ip link del dev bond1

When the device is put administratively down the "rx-vlan-filter"

feature is disabled, so the 8021q module will not remove VLAN 0 and the

memory will be leaked [1].

Another problem that can happen is that the kernel can automatically

delete VLAN 0 when the device is put administratively down despite not

adding it when the device was put administratively up since during

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References