CVE-2025-38720 describes a deadlock vulnerability in the Linux kernel's hibmcge network driver. This flaw, categorized as CWE-667 (Improper Synchronization), arises when multiple hibmcge devices on the same PCI bus attempt to acquire the rtnl_lock during the reset process, leading to a system hang. With a CVSS score of 5.5 (Medium), this vulnerability has a local attack vector (AV:L) and low attack complexity (AC:L), requiring local user privileges (PR:L) to trigger. A successful exploit could lead to a denial of service (A:H) by rendering the system unresponsive, though it does not impact confidentiality or integrity. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, indicating a low level of public awareness or concern at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 6.14, < 6.15.11CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 6.16, < 6.16.2CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
6.17CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.