CVE-2025-38331

CVE-2025-38331 addresses a stability issue in the Linux kernel's Cortina ethernet driver, specifically impacting Debian and other Linux distributions. The vulnerability stems from an incomplete utilization of the hardware's TCP Offload Engine (TOE) and TCP Segmentation Offload (TSO) features, leading to driver instability, lock-ups, and crashes. Rated with a CVSS score of 5.5 MEDIUM, this vulnerability has a local attack vector (AV:L) and low attack complexity (AC:L), requiring local privileges (PR:L). Its primary impact is high availability loss (A:H), as the system can become unstable and crash, though confidentiality and integrity are not directly affected. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Despite the lack of exploit code, the vulnerability has garnered some community attention with two mentions and two media articles, indicating awareness within the security community.