CVE-2025-38490

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: libwx: remove duplicate page_pool_put_full_page()

page_pool_put_full_page() should only be invoked when freeing Rx buffers

or building a skb if the size is too short. At other times, the pages

need to be reused. So remove the redundant page put. In the original

code, double free pages cause kernel panic:

[ 876.949834] __irq_exit_rcu+0xc7/0x130

[ 876.949836] common_interrupt+0xb8/0xd0

[ 876.949838] </IRQ>

[ 876.949838] <TASK>

[ 876.949840] asm_common_interrupt+0x22/0x40

[ 876.949841] RIP: 0010:cpuidle_enter_state+0xc2/0x420

[ 876.949843] Code: 00 00 e8 d1 1d 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 cd fc 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d

[ 876.949844] RSP: 0018:ffffaa7340267e78 EFLAGS: 00000246

[ 876.949845] RAX: ffff9e3f135be000 RBX: 0000000000000002 RCX: 0000000000000000

[ 876.949846] RDX: 000000cc2

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References