GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38262 (GCVE-0-2025-38262)

Vulnerability from cvelistv5 – Published: 2025-07-09 10:42 – Updated: 2026-08-05 12:00
VLAI
Title
tty: serial: uartlite: register uart driver in init
Summary
In the Linux kernel, the following vulnerability has been resolved: tty: serial: uartlite: register uart driver in init When two instances of uart devices are probing, a concurrency race can occur. If one thread calls uart_register_driver function, which first allocates and assigns memory to 'uart_state' member of uart_driver structure, the other instance can bypass uart driver registration and call ulite_assign. This calls uart_add_one_port, which expects the uart driver to be fully initialized. This leads to a kernel panic due to a null pointer dereference: [ 8.143581] BUG: kernel NULL pointer dereference, address: 00000000000002b8 [ 8.156982] #PF: supervisor write access in kernel mode [ 8.156984] #PF: error_code(0x0002) - not-present page [ 8.156986] PGD 0 P4D 0 ... [ 8.180668] RIP: 0010:mutex_lock+0x19/0x30 [ 8.188624] Call Trace: [ 8.188629] ? __die_body.cold+0x1a/0x1f [ 8.195260] ? page_fault_oops+0x15c/0x290 [ 8.209183] ? __irq_resolve_mapping+0x47/0x80 [ 8.209187] ? exc_page_fault+0x64/0x140 [ 8.209190] ? asm_exc_page_fault+0x22/0x30 [ 8.209196] ? mutex_lock+0x19/0x30 [ 8.223116] uart_add_one_port+0x60/0x440 [ 8.223122] ? proc_tty_register_driver+0x43/0x50 [ 8.223126] ? tty_register_driver+0x1ca/0x1e0 [ 8.246250] ulite_probe+0x357/0x4b0 [uartlite] To prevent it, move uart driver registration in to init function. This will ensure that uart_driver is always registered when probe function is called.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 238b8721a554a33a451a3f13bdb5be8fe5cfc927 , < 5015eed450005bab6e5cb6810f7a62eab0434fc4 (git)
Affected: 238b8721a554a33a451a3f13bdb5be8fe5cfc927 , < 9c905fdbba68a6d73d39a6b7de9b9f0d6c46df87 (git)
Affected: 238b8721a554a33a451a3f13bdb5be8fe5cfc927 , < 6db06aaea07bb7c8e33a425cf7b98bf29ee6056e (git)
Affected: 238b8721a554a33a451a3f13bdb5be8fe5cfc927 , < 8e958d10dd0ce5ae674cce460db5c9ca3f25243b (git)
Affected: 238b8721a554a33a451a3f13bdb5be8fe5cfc927 , < 685d29f2c5057b32c7b1b46f2a7d303b926c8f72 (git)
Affected: 238b8721a554a33a451a3f13bdb5be8fe5cfc927 , < f5e4229d94792b40e750f30c92bcf7a3107c72ef (git)
Affected: 238b8721a554a33a451a3f13bdb5be8fe5cfc927 , < 6bd697b5fc39fd24e2aa418c7b7d14469f550a93 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.20
Unaffected: 0 , < 2.6.20 (semver)
Unaffected: 5.4.296 , ≤ 5.4.* (semver)
Unaffected: 5.15.187 , ≤ 5.15.* (semver)
Unaffected: 6.1.143 , ≤ 6.1.* (semver)
Unaffected: 6.6.96 , ≤ 6.6.* (semver)
Unaffected: 6.12.36 , ≤ 6.12.* (semver)
Unaffected: 6.15.5 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:36:04.315Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/uartlite.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5015eed450005bab6e5cb6810f7a62eab0434fc4",
              "status": "affected",
              "version": "238b8721a554a33a451a3f13bdb5be8fe5cfc927",
              "versionType": "git"
            },
            {
              "lessThan": "9c905fdbba68a6d73d39a6b7de9b9f0d6c46df87",
              "status": "affected",
              "version": "238b8721a554a33a451a3f13bdb5be8fe5cfc927",
              "versionType": "git"
            },
            {
              "lessThan": "6db06aaea07bb7c8e33a425cf7b98bf29ee6056e",
              "status": "affected",
              "version": "238b8721a554a33a451a3f13bdb5be8fe5cfc927",
              "versionType": "git"
            },
            {
              "lessThan": "8e958d10dd0ce5ae674cce460db5c9ca3f25243b",
              "status": "affected",
              "version": "238b8721a554a33a451a3f13bdb5be8fe5cfc927",
              "versionType": "git"
            },
            {
              "lessThan": "685d29f2c5057b32c7b1b46f2a7d303b926c8f72",
              "status": "affected",
              "version": "238b8721a554a33a451a3f13bdb5be8fe5cfc927",
              "versionType": "git"
            },
            {
              "lessThan": "f5e4229d94792b40e750f30c92bcf7a3107c72ef",
              "status": "affected",
              "version": "238b8721a554a33a451a3f13bdb5be8fe5cfc927",
              "versionType": "git"
            },
            {
              "lessThan": "6bd697b5fc39fd24e2aa418c7b7d14469f550a93",
              "status": "affected",
              "version": "238b8721a554a33a451a3f13bdb5be8fe5cfc927",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/uartlite.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.20"
            },
            {
              "lessThan": "2.6.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.187",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.143",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.96",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.36",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.5",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: uartlite: register uart driver in init\n\nWhen two instances of uart devices are probing, a concurrency race can\noccur. If one thread calls uart_register_driver function, which first\nallocates and assigns memory to \u0027uart_state\u0027 member of uart_driver\nstructure, the other instance can bypass uart driver registration and\ncall ulite_assign. This calls uart_add_one_port, which expects the uart\ndriver to be fully initialized. This leads to a kernel panic due to a\nnull pointer dereference:\n\n[    8.143581] BUG: kernel NULL pointer dereference, address: 00000000000002b8\n[    8.156982] #PF: supervisor write access in kernel mode\n[    8.156984] #PF: error_code(0x0002) - not-present page\n[    8.156986] PGD 0 P4D 0\n...\n[    8.180668] RIP: 0010:mutex_lock+0x19/0x30\n[    8.188624] Call Trace:\n[    8.188629]  ? __die_body.cold+0x1a/0x1f\n[    8.195260]  ? page_fault_oops+0x15c/0x290\n[    8.209183]  ? __irq_resolve_mapping+0x47/0x80\n[    8.209187]  ? exc_page_fault+0x64/0x140\n[    8.209190]  ? asm_exc_page_fault+0x22/0x30\n[    8.209196]  ? mutex_lock+0x19/0x30\n[    8.223116]  uart_add_one_port+0x60/0x440\n[    8.223122]  ? proc_tty_register_driver+0x43/0x50\n[    8.223126]  ? tty_register_driver+0x1ca/0x1e0\n[    8.246250]  ulite_probe+0x357/0x4b0 [uartlite]\n\nTo prevent it, move uart driver registration in to init function. This\nwill ensure that uart_driver is always registered when probe function\nis called."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable window lives entirely in the uartlite platform-driver probe path, reachable only from local device/module instantiation (module load, deferred-probe worker, DT-overlay/FPGA-region or sysfs bind) on the affected host. No remote, adjacent, or physical-interface data reaches this code \u2014 the race is in driver registration, not in serial data handling.\nAC:L - Success requires the system to be in a specific state the attacker cannot create or influence \u2014 two uartlite instances probing simultaneously with one thread inside the few-microsecond window between `drv-\u003estate = kzalloc()` and `tty_port_init()`/`tty_register_driver()`. There is no way to widen, stall, or re-trigger that window from a local attacker\u0027s position, so it is a condition truly beyond attacker control.\nPR:L - Scored as a local unprivileged attacker present on an affected FPGA/embedded system when the concurrent probe occurs; the code itself performs no capability check. Deliberately forcing a probe (modprobe, sysfs bind, DT overlay) would need root, but the higher-severity assumption of a merely unprivileged local presence is used here.\nUI:N - The race fires during driver/device initialization driven by the kernel\u0027s own probe machinery; no victim action such as opening a device, mounting a filesystem, or loading a file is required.\nS:U - The corruption is confined to kernel data structures (`uart_driver.state`, `tty_port`, slab objects) within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is not a bare NULL dereference \u2014 `uart_add_one_port()` reads through a half-built or already-`kfree()`d `drv-\u003estate`/`drv-\u003etty_driver` (`drv-\u003etty_driver-\u003eminor_start`, `state-\u003euart_port`), giving reads of freed slab memory whose contents can be reallocated to other objects, so it is leverageable for kernel memory disclosure.\nI:H - In the double-registration interleaving the losing thread\u0027s error path `kfree()`s the shared `drv-\u003estate` array while the winner writes through it (`atomic_set(\u0026state-\u003erefcount,1)`, `init_waitqueue_head()`, `state-\u003euart_port = uport`, `tty_port_link_device()`), a use-after-free write that plants kernel pointers and performs list/mutex operations inside a freed, potentially reallocated slab object \u2014 memory corruption usable for control-flow hijacking.\nA:H - The documented and reproduced outcome is an immediate kernel panic (`BUG: kernel NULL pointer dereference` in `mutex_lock` from `uart_add_one_port`), and `BUG_ON(drv-\u003estate)` in the concurrent `uart_register_driver()` is a second crash path. On 5.4\u20136.12 the oops happens while the global `port_mutex` is held, permanently deadlocking all further serial-port and console registration even if the box survives the oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:50.359Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5015eed450005bab6e5cb6810f7a62eab0434fc4"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c905fdbba68a6d73d39a6b7de9b9f0d6c46df87"
        },
        {
          "url": "https://git.kernel.org/stable/c/6db06aaea07bb7c8e33a425cf7b98bf29ee6056e"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e958d10dd0ce5ae674cce460db5c9ca3f25243b"
        },
        {
          "url": "https://git.kernel.org/stable/c/685d29f2c5057b32c7b1b46f2a7d303b926c8f72"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5e4229d94792b40e750f30c92bcf7a3107c72ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bd697b5fc39fd24e2aa418c7b7d14469f550a93"
        }
      ],
      "title": "tty: serial: uartlite: register uart driver in init",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38262",
    "datePublished": "2025-07-09T10:42:37.410Z",
    "dateReserved": "2025-04-16T04:51:23.997Z",
    "dateUpdated": "2026-08-05T12:00:50.359Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38262",
      "date": "2026-09-17",
      "epss": "0.00165",
      "percentile": "0.06136"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38262\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-09T11:15:28.570\",\"lastModified\":\"2026-07-30T06:23:05.010\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntty: serial: uartlite: register uart driver in init\\n\\nWhen two instances of uart devices are probing, a concurrency race can\\noccur. If one thread calls uart_register_driver function, which first\\nallocates and assigns memory to \u0027uart_state\u0027 member of uart_driver\\nstructure, the other instance can bypass uart driver registration and\\ncall ulite_assign. This calls uart_add_one_port, which expects the uart\\ndriver to be fully initialized. This leads to a kernel panic due to a\\nnull pointer dereference:\\n\\n[    8.143581] BUG: kernel NULL pointer dereference, address: 00000000000002b8\\n[    8.156982] #PF: supervisor write access in kernel mode\\n[    8.156984] #PF: error_code(0x0002) - not-present page\\n[    8.156986] PGD 0 P4D 0\\n...\\n[    8.180668] RIP: 0010:mutex_lock+0x19/0x30\\n[    8.188624] Call Trace:\\n[    8.188629]  ? __die_body.cold+0x1a/0x1f\\n[    8.195260]  ? page_fault_oops+0x15c/0x290\\n[    8.209183]  ? __irq_resolve_mapping+0x47/0x80\\n[    8.209187]  ? exc_page_fault+0x64/0x140\\n[    8.209190]  ? asm_exc_page_fault+0x22/0x30\\n[    8.209196]  ? mutex_lock+0x19/0x30\\n[    8.223116]  uart_add_one_port+0x60/0x440\\n[    8.223122]  ? proc_tty_register_driver+0x43/0x50\\n[    8.223126]  ? tty_register_driver+0x1ca/0x1e0\\n[    8.246250]  ulite_probe+0x357/0x4b0 [uartlite]\\n\\nTo prevent it, move uart driver registration in to init function. This\\nwill ensure that uart_driver is always registered when probe function\\nis called.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tty: serial: uartlite: registrar el controlador UART en init. Cuando dos instancias de dispositivos UART est\u00e1n realizando pruebas, puede producirse una ejecuci\u00f3n de concurrencia. Si un subproceso invoca la funci\u00f3n uart_register_driver, que primero asigna memoria al miembro \u0027uart_state\u0027 de la estructura uart_driver, la otra instancia puede omitir el registro del controlador UART y llamar a ulite_assign. Esto invoca uart_add_one_port, que espera que el controlador UART est\u00e9 completamente inicializado. Esto genera un p\u00e1nico del kernel debido a una desreferencia de puntero nulo: [8.143581] ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 00000000000002b8 [8.156982] #PF: acceso de escritura del supervisor en modo kernel [8.156984] #PF: error_code(0x0002) - p\u00e1gina no presente [8.156986] PGD 0 P4D 0 ... [8.180668] RIP: 0010:mutex_lock+0x19/0x30 [8.188624] Rastreo de llamadas: [ 8.188629] ? __die_body.cold+0x1a/0x1f [ 8.195260] ? page_fault_oops+0x15c/0x290 [ 8.209183] ? __irq_resolve_mapping+0x47/0x80 [ 8.209187] ? exc_page_fault+0x64/0x140 [ 8.209190] ? asm_exc_page_fault+0x22/0x30 [ 8.209196] ? mutex_lock+0x19/0x30 [ 8.223116] uart_add_one_port+0x60/0x440 [ 8.223122] ? proc_tty_register_driver+0x43/0x50 [ 8.223126] ? tty_register_driver+0x1ca/0x1e0 [ 8.246250] ulite_probe+0x357/0x4b0 [uartlite] Para evitarlo, mueva el registro del controlador UART a la funci\u00f3n init. Esto garantizar\u00e1 que uart_driver siempre se registre al llamar a la funci\u00f3n de sondeo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/tty/serial/uartlite.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"238b8721a554a33a451a3f13bdb5be8fe5cfc927\",\"lessThan\":\"5015eed450005bab6e5cb6810f7a62eab0434fc4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"238b8721a554a33a451a3f13bdb5be8fe5cfc927\",\"lessThan\":\"9c905fdbba68a6d73d39a6b7de9b9f0d6c46df87\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"238b8721a554a33a451a3f13bdb5be8fe5cfc927\",\"lessThan\":\"6db06aaea07bb7c8e33a425cf7b98bf29ee6056e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"238b8721a554a33a451a3f13bdb5be8fe5cfc927\",\"lessThan\":\"8e958d10dd0ce5ae674cce460db5c9ca3f25243b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"238b8721a554a33a451a3f13bdb5be8fe5cfc927\",\"lessThan\":\"685d29f2c5057b32c7b1b46f2a7d303b926c8f72\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"238b8721a554a33a451a3f13bdb5be8fe5cfc927\",\"lessThan\":\"f5e4229d94792b40e750f30c92bcf7a3107c72ef\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"238b8721a554a33a451a3f13bdb5be8fe5cfc927\",\"lessThan\":\"6bd697b5fc39fd24e2aa418c7b7d14469f550a93\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/tty/serial/uartlite.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.20\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.20\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.296\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.187\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.143\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.96\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.36\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.5\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.20\",\"versionEndExcluding\":\"5.4.296\",\"matchCriteriaId\":\"092812DB-392E-4683-B1DB-4F3057267FC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.15.187\",\"matchCriteriaId\":\"4D0C2F57-3EDC-4D83-B7DD-11B0CFEF0FED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.143\",\"matchCriteriaId\":\"FC77EF56-FA90-40B6-AF3C-9BBE6D4BEAD8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.96\",\"matchCriteriaId\":\"6AB3EB1A-48DE-47F4-9202-D0C58A0F6060\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.36\",\"matchCriteriaId\":\"2BD88DEC-018F-4F40-8E29-A2CA89813EBA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.5\",\"matchCriteriaId\":\"0CC768E2-3BBC-4A6E-9C2F-ECB27A703C2D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5015eed450005bab6e5cb6810f7a62eab0434fc4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/685d29f2c5057b32c7b1b46f2a7d303b926c8f72\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6bd697b5fc39fd24e2aa418c7b7d14469f550a93\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6db06aaea07bb7c8e33a425cf7b98bf29ee6056e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8e958d10dd0ce5ae674cce460db5c9ca3f25243b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9c905fdbba68a6d73d39a6b7de9b9f0d6c46df87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f5e4229d94792b40e750f30c92bcf7a3107c72ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:09:22+00:00",
      "cve": "CVE-2025-38262",
      "id": "CVE-2025-38262",
      "initial_release_date": "2025-07-09T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tty: serial: uartlite: register uart driver in init",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38262.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.