CVE-2025-38491: linux kernel from 5.10.228 (inclusive), before 5.11 (exclusive), from 5.15.169 (inclusive), before 5.16 (exclusive)…

Affected technology

linux kernel · from 5.10.228 (inclusive), before 5.11 (exclusive)
linux

linux kernel · from 5.15.169 (inclusive), before 5.16 (exclusive)
linux

linux kernel · from 5.19 (inclusive), before 6.1.149 (exclusive)
linux

linux kernel · from 6.2 (inclusive), before 6.6.101 (exclusive)
linux

linux kernel · from 6.7 (inclusive), before 6.12.40 (exclusive)
linux

linux kernel · from 6.13 (inclusive), before 6.15.8 (exclusive)
linux

linux kernel · 6.16 · update rc1
linux

linux kernel · 6.16 · update rc2
linux

linux kernel · 6.16 · update rc3
linux

linux kernel · 6.16 · update rc4
linux

linux kernel · 6.16 · update rc5
linux

linux kernel · 6.16 · update rc6
linux

debian linux · 11.0
debian

Linux · 0530020a7c8f2204e784f0dbdc882bbd961fdbde to before 5586518bec27666c747cd52aabb62d485686d0bf, 0530020a7c8f2204e784f0dbdc882bbd961fdbde to before 75a4c9ab8a7af0d76b31ccd1188ed178c38b35d2, 0530020a7c8f2204e784f0dbdc882bbd961fdbde to before 54999dea879fecb761225e28f274b40662918c30, 0530020a7c8f2204e784f0dbdc882bbd961fdbde to before 1d82a8fe6ee4afdc92f4e8808c9dad2a6095bbc5, 0530020a7c8f2204e784f0dbdc882bbd961fdbde to before f8a1d9b18c5efc76784f5a326e905f641f839894, 609937aa962a62e93acfc04dd370b665e6152dfb, 6654efe264b014d8ea9fc38f79efb568b1b79069, 5.10.228 to before 5.11, 5.15.169 to before 5.16
Linux

Linux · 5.19
Linux

SIMATIC CN 4100 · 0 to before V5.0
Siemens

Component: Not specified by the source
File: net/mptcp/options.c, net/mptcp/protocol.c, net/mptcp/protocol.h, net/mptcp/subflow.c

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 8.2/10) rates confidentiality impact as none; integrity impact as low; availability impact as high. NVD’s CVSS 3.1 assessment (base score 5.5/10) rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.