Vulnerability-Lookup

CERTFR-2025-AVI-0698

Vulnerability from certfr_avis - Published: 2025-08-14 - Updated: 2025-08-14

De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Debian	Debian	Debian bookworm versions antérieures à 6.1.147-1
	Debian	Debian	Debian trixie versions antérieures à 6.12.41-1

References

Title

Publication Time

CVE-2025-38396 (GCVE-0-2025-38396)

Vulnerability from cvelistv5 – Published: 2025-07-25 12:53 – Updated: 2026-08-05 12:01

Title

fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass

Summary

In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create anonymous inodes with proper security context. This replaces the current pattern of calling alloc_anon_inode() followed by inode_init_security_anon() for creating security context manually. This change also fixes a security regression in secretmem where the S_PRIVATE flag was not cleared after alloc_anon_inode(), causing LSM/SELinux checks to be bypassed for secretmem file descriptors. As guest_memfd currently resides in the KVM module, we need to export this symbol for use outside the core kernel. In the future, guest_memfd might be moved to core-mm, at which point the symbols no longer would have to be exported. When/if that happens is still unclear.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/66d29d757c968d2be…
https://git.kernel.org/stable/c/e3eed01347721cd7a…
https://git.kernel.org/stable/c/f94c422157f3e43dd…
https://git.kernel.org/stable/c/6ca45ea48530332a4…
https://git.kernel.org/stable/c/cbe4134ea4bc49323…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2bfe15c5261212130f1a71f32a300bcf426443d4 , < 66d29d757c968d2bee9124816da5d718eb352959 (git) Affected: 2bfe15c5261212130f1a71f32a300bcf426443d4 , < e3eed01347721cd7a8819568161c91d538fbf229 (git) Affected: 2bfe15c5261212130f1a71f32a300bcf426443d4 , < f94c422157f3e43dd31990567b3e5d54b3e5b32b (git) Affected: 2bfe15c5261212130f1a71f32a300bcf426443d4 , < 6ca45ea48530332a4ba09595767bd26d3232743b (git) Affected: 2bfe15c5261212130f1a71f32a300bcf426443d4 , < cbe4134ea4bc493239786220bd69cb8a13493190 (git)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.146 , ≤ 6.1.* (semver) Unaffected: 6.6.97 , ≤ 6.6.* (semver) Unaffected: 6.12.37 , ≤ 6.12.* (semver) Unaffected: 6.15.6 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:29.745Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/anon_inodes.c",
            "include/linux/fs.h",
            "mm/secretmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "66d29d757c968d2bee9124816da5d718eb352959",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "e3eed01347721cd7a8819568161c91d538fbf229",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "f94c422157f3e43dd31990567b3e5d54b3e5b32b",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "6ca45ea48530332a4ba09595767bd26d3232743b",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "cbe4134ea4bc493239786220bd69cb8a13493190",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/anon_inodes.c",
            "include/linux/fs.h",
            "mm/secretmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass\n\nExport anon_inode_make_secure_inode() to allow KVM guest_memfd to create\nanonymous inodes with proper security context. This replaces the current\npattern of calling alloc_anon_inode() followed by\ninode_init_security_anon() for creating security context manually.\n\nThis change also fixes a security regression in secretmem where the\nS_PRIVATE flag was not cleared after alloc_anon_inode(), causing\nLSM/SELinux checks to be bypassed for secretmem file descriptors.\n\nAs guest_memfd currently resides in the KVM module, we need to export this\nsymbol for use outside the core kernel. In the future, guest_memfd might be\nmoved to core-mm, at which point the symbols no longer would have to be\nexported. When/if that happens is still unclear."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable object is created and operated on through local syscalls \u2014 `memfd_secret(2)`, `mmap()`, and `ftruncate()` on the resulting file descriptor. No network or adjacent-network path exists.\nAC:L - Every secretmem inode is unconditionally created with S_PRIVATE set \u2014 there is no race, no memory-layout dependency, and no timing element; the attacker simply calls memfd_secret() or receives such an fd. CONFIG_SECRETMEM defaults to y and secretmem_enable defaults to 1 since 6.6, so the affected path is present in stock distro kernels.\nPR:L - memfd_secret(2) performs no capability or permission check whatsoever, so any unprivileged local user \u2014 including one confined inside a container or user namespace \u2014 can create and operate on secretmem fds. Local account access is still required, so this is not PR:N.\nUI:N - The attacker triggers the entire sequence from their own process; no victim action, mount, or file open is needed.\nS:U - The missing enforcement affects kernel-managed objects under the kernel\u0027s own security authority; no VM, IOMMU, or hypervisor boundary is crossed. Per standard kernel scoring, MAC-policy enforcement failures remain Unchanged.\nC:H - With S_PRIVATE set, SELinux inode_has_perm() and Smack\u0027s checks return 0, so FILE__READ/FILE__MAP on a secretmem object are never evaluated \u2014 a confined domain that receives such an fd can mmap and read its contents despite policy denying it. secretmem is by design the store for the system\u0027s most sensitive data (crypto keys), and the accesses generate no AVC audit records.\nI:H - The same bypass permits PROT_WRITE shared mappings, and security_inode_setattr() is skipped entirely, so ftruncate/chown/chmod on a policy-protected secretmem object go unmediated. An attacker can overwrite or re-own another security domain\u0027s key material that the MAC policy was configured to protect.\nA:H - Because setattr and write-mapping are both unmediated, an attacker can truncate and overwrite the secretmem object a victim service depends on, destroying its key material and causing that service to fail; the unreclaimable, unmovable nature of secretmem pages compounds the effect."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:34.204Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/66d29d757c968d2bee9124816da5d718eb352959"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3eed01347721cd7a8819568161c91d538fbf229"
        },
        {
          "url": "https://git.kernel.org/stable/c/f94c422157f3e43dd31990567b3e5d54b3e5b32b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ca45ea48530332a4ba09595767bd26d3232743b"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbe4134ea4bc493239786220bd69cb8a13493190"
        }
      ],
      "title": "fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38396",
    "datePublished": "2025-07-25T12:53:40.761Z",
    "dateReserved": "2025-04-16T04:51:24.011Z",
    "dateUpdated": "2026-08-05T12:01:34.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38399 (GCVE-0-2025-38399)

Vulnerability from cvelistv5 – Published: 2025-07-25 12:53 – Updated: 2026-08-05 12:01

Title

scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() The function core_scsi3_decode_spec_i_port(), in its error code path, unconditionally calls core_scsi3_lunacl_undepend_item() passing the dest_se_deve pointer, which may be NULL. This can lead to a NULL pointer dereference if dest_se_deve remains unset. SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg Unable to handle kernel paging request at virtual address dfff800000000012 Call trace: core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P) core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod] core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod] target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod] Fix this by adding a NULL check before calling core_scsi3_lunacl_undepend_item()

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/70ddb8133fdb512d4…
https://git.kernel.org/stable/c/1129e0e0a833acf90…
https://git.kernel.org/stable/c/1627dda4d70ceb1ba…
https://git.kernel.org/stable/c/55dfffc5e94730370…
https://git.kernel.org/stable/c/7296c938df2445f34…
https://git.kernel.org/stable/c/c412185d557578d3f…
https://git.kernel.org/stable/c/d8ab68bdb294b09a7…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f32ba612ef0f8eecaf6d2a5b04076ee7ea9ed039 , < 70ddb8133fdb512d4b1f2b4fd1c9e518514f182c (git) Affected: f32ba612ef0f8eecaf6d2a5b04076ee7ea9ed039 , < 1129e0e0a833acf90429e0f13951068d5f026e4f (git) Affected: f32ba612ef0f8eecaf6d2a5b04076ee7ea9ed039 , < 1627dda4d70ceb1ba62af2e401af73c09abb1eb5 (git) Affected: f32ba612ef0f8eecaf6d2a5b04076ee7ea9ed039 , < 55dfffc5e94730370b08de02c0cf3b7c951bbe9e (git) Affected: f32ba612ef0f8eecaf6d2a5b04076ee7ea9ed039 , < 7296c938df2445f342be456a6ff0b3931d97f4e5 (git) Affected: f32ba612ef0f8eecaf6d2a5b04076ee7ea9ed039 , < c412185d557578d3f936537ed639c4ffaaed4075 (git) Affected: f32ba612ef0f8eecaf6d2a5b04076ee7ea9ed039 , < d8ab68bdb294b09a761e967dad374f2965e1913f (git)
Linux	Linux	Affected: 5.9 Unaffected: 0 , < 5.9 (semver) Unaffected: 5.10.240 , ≤ 5.10.* (semver) Unaffected: 5.15.187 , ≤ 5.15.* (semver) Unaffected: 6.1.144 , ≤ 6.1.* (semver) Unaffected: 6.6.97 , ≤ 6.6.* (semver) Unaffected: 6.12.37 , ≤ 6.12.* (semver) Unaffected: 6.15.6 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:31.744Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/target_core_pr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "70ddb8133fdb512d4b1f2b4fd1c9e518514f182c",
              "status": "affected",
              "version": "f32ba612ef0f8eecaf6d2a5b04076ee7ea9ed039",
              "versionType": "git"
            },
            {
              "lessThan": "1129e0e0a833acf90429e0f13951068d5f026e4f",
              "status": "affected",
              "version": "f32ba612ef0f8eecaf6d2a5b04076ee7ea9ed039",
              "versionType": "git"
            },
            {
              "lessThan": "1627dda4d70ceb1ba62af2e401af73c09abb1eb5",
              "status": "affected",
              "version": "f32ba612ef0f8eecaf6d2a5b04076ee7ea9ed039",
              "versionType": "git"
            },
            {
              "lessThan": "55dfffc5e94730370b08de02c0cf3b7c951bbe9e",
              "status": "affected",
              "version": "f32ba612ef0f8eecaf6d2a5b04076ee7ea9ed039",
              "versionType": "git"
            },
            {
              "lessThan": "7296c938df2445f342be456a6ff0b3931d97f4e5",
              "status": "affected",
              "version": "f32ba612ef0f8eecaf6d2a5b04076ee7ea9ed039",
              "versionType": "git"
            },
            {
              "lessThan": "c412185d557578d3f936537ed639c4ffaaed4075",
              "status": "affected",
              "version": "f32ba612ef0f8eecaf6d2a5b04076ee7ea9ed039",
              "versionType": "git"
            },
            {
              "lessThan": "d8ab68bdb294b09a761e967dad374f2965e1913f",
              "status": "affected",
              "version": "f32ba612ef0f8eecaf6d2a5b04076ee7ea9ed039",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/target_core_pr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.187",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.144",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()\n\nThe function core_scsi3_decode_spec_i_port(), in its error code path,\nunconditionally calls core_scsi3_lunacl_undepend_item() passing the\ndest_se_deve pointer, which may be NULL.\n\nThis can lead to a NULL pointer dereference if dest_se_deve remains\nunset.\n\nSPC-3 PR SPEC_I_PT: Unable to locate dest_tpg\nUnable to handle kernel paging request at virtual address dfff800000000012\nCall trace:\n  core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P)\n  core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod]\n  core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod]\n  target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod]\n\nFix this by adding a NULL check before calling\ncore_scsi3_lunacl_undepend_item()"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is in the fabric-independent LIO SCSI target core, reached by parsing a PERSISTENT RESERVE OUT CDB and parameter list sent by a remote initiator; the flagship fabric (iscsi_target) accepts these over TCP/3260, so a remote peer on the network can deliver the malicious payload.\nAC:L - The attacker fully controls every precondition (service action, res_key=0, sa_res_key!=0, SPEC_I_PT bit, and the parameter list length/TransportID contents), and the NULL pointer is unconditionally present on the very first list entry, so a single malformed PR OUT command crashes the kernel deterministically with no race or memory-layout dependency.\nPR:N - LIO iSCSI targets are routinely deployed without CHAP, where the only \"credential\" is a self-asserted InitiatorName that is discoverable via a SendTargets discovery session, and demo-mode (generate_node_acls=1) grants any peer a mapped LUN outright \u2014 so an unauthenticated network attacker can establish the nexus needed to issue the command.\nUI:N - The crash is triggered purely by the attacker sending one SCSI command over an established I_T nexus; no action by any local user or administrator is needed.\nS:U - The NULL dereference occurs in the kernel that owns the target device and its impact is confined to that same kernel\u0027s security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:N - The fault is a read of a fixed small offset (se_deve-\u003ese_lun_acl) off a NULL pointer; no attacker-influenced offset, no out-of-bounds read, and no data is returned to the initiator, so nothing is disclosed.\nI:N - No memory is written and no attacker-controlled data reaches a store; the dereference faults on a read before any state modification, giving no write or control-flow primitive.\nA:H - The NULL pointer dereference produces a kernel oops (full panic with panic_on_oops) that can be re-triggered at will by an unauthenticated initiator, and the killed command context strands se_lun-\u003elun_ref percpu references so the target subsystem hangs on teardown."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:36.347Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/70ddb8133fdb512d4b1f2b4fd1c9e518514f182c"
        },
        {
          "url": "https://git.kernel.org/stable/c/1129e0e0a833acf90429e0f13951068d5f026e4f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1627dda4d70ceb1ba62af2e401af73c09abb1eb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/55dfffc5e94730370b08de02c0cf3b7c951bbe9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/7296c938df2445f342be456a6ff0b3931d97f4e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c412185d557578d3f936537ed639c4ffaaed4075"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8ab68bdb294b09a761e967dad374f2965e1913f"
        }
      ],
      "title": "scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38399",
    "datePublished": "2025-07-25T12:53:43.211Z",
    "dateReserved": "2025-04-16T04:51:24.012Z",
    "dateUpdated": "2026-08-05T12:01:36.347Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38400 (GCVE-0-2025-38400)

Vulnerability from cvelistv5 – Published: 2025-07-25 12:53 – Updated: 2026-07-14 12:42

Title

nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.

Summary

In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. syzbot reported a warning below [1] following a fault injection in nfs_fs_proc_net_init(). [0] When nfs_fs_proc_net_init() fails, /proc/net/rpc/nfs is not removed. Later, rpc_proc_exit() tries to remove /proc/net/rpc, and the warning is logged as the directory is not empty. Let's handle the error of nfs_fs_proc_net_init() properly. [0]: FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) should_fail_ex (lib/fault-inject.c:73 lib/fault-inject.c:174) should_failslab (mm/failslab.c:46) kmem_cache_alloc_noprof (mm/slub.c:4178 mm/slub.c:4204) __proc_create (fs/proc/generic.c:427) proc_create_reg (fs/proc/generic.c:554) proc_create_net_data (fs/proc/proc_net.c:120) nfs_fs_proc_net_init (fs/nfs/client.c:1409) nfs_net_init (fs/nfs/inode.c:2600) ops_init (net/core/net_namespace.c:138) setup_net (net/core/net_namespace.c:443) copy_net_ns (net/core/net_namespace.c:576) create_new_namespaces (kernel/nsproxy.c:110) unshare_nsproxy_namespaces (kernel/nsproxy.c:218 (discriminator 4)) ksys_unshare (kernel/fork.c:3123) __x64_sys_unshare (kernel/fork.c:3190) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> [1]: remove_proc_entry: removing non-empty directory 'net/rpc', leaking at least 'nfs' WARNING: CPU: 1 PID: 6120 at fs/proc/generic.c:727 remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727 Modules linked in: CPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727 Code: 3c 02 00 0f 85 85 00 00 00 48 8b 93 d8 00 00 00 4d 89 f0 4c 89 e9 48 c7 c6 40 ba a2 8b 48 c7 c7 60 b9 a2 8b e8 33 81 1d ff 90 <0f> 0b 90 90 e9 5f fe ff ff e8 04 69 5e ff 90 48 b8 00 00 00 00 00 RSP: 0018:ffffc90003637b08 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88805f534140 RCX: ffffffff817a92c8 RDX: ffff88807da99e00 RSI: ffffffff817a92d5 RDI: 0000000000000001 RBP: ffff888033431ac0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff888033431a00 R13: ffff888033431ae4 R14: ffff888033184724 R15: dffffc0000000000 FS: 0000555580328500(0000) GS:ffff888124a62000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f71733743e0 CR3: 000000007f618000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> sunrpc_exit_net+0x46/0x90 net/sunrpc/sunrpc_syms.c:76 ops_exit_list net/core/net_namespace.c:200 [inline] ops_undo_list+0x2eb/0xab0 net/core/net_namespace.c:253 setup_net+0x2e1/0x510 net/core/net_namespace.c:457 copy_net_ns+0x2a6/0x5f0 net/core/net_namespace.c:574 create_new_namespaces+0x3ea/0xa90 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218 ksys_unshare+0x45b/0xa40 kernel/fork.c:3121 __do_sys_unshare kernel/fork.c:3192 [inline] __se_sys_unshare kernel/fork.c:3190 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3190 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa1a6b8e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c ---truncated---

Severity

No CVSS data available.

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/8785701fd7cd52ae7…
https://git.kernel.org/stable/c/412534a1fb76958b8…
https://git.kernel.org/stable/c/b92397ce96743e4cc…
https://git.kernel.org/stable/c/7701c245ff1ac1a12…
https://git.kernel.org/stable/c/d0877c479f44fe475…
https://git.kernel.org/stable/c/3c94212b57bedec3a…
https://git.kernel.org/stable/c/6acf340f8c1d296bc…
https://git.kernel.org/stable/c/e8d6f3ab59468e230…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

5 products

Vendor	Product	Version
Linux	Linux	Affected: 31dd0cda5aa0547de447aaf184812f85ccc34044 , < 8785701fd7cd52ae74c0d2b35b82568df74e9dbb (git) Affected: 6eef21eb7a165601882dad0419a630e32d2d7a2c , < 412534a1fb76958b88dca48360c6f3ad4f3390f4 (git) Affected: 0bbd429260821dfb81478749837d3e6377949ac6 , < b92397ce96743e4cc090207e2df2a856cb4cef08 (git) Affected: 9dd86e9d34b1078dcd647220e96a205028bf4e6f , < 7701c245ff1ac1a126bf431e72b24547519046ff (git) Affected: 53a0365c9f9f66e1a981bf9188d8716d682e0739 , < d0877c479f44fe475f4c8c02c88ce9ad43e90298 (git) Affected: d47151b79e3220e72ae323b8b8e9d6da20dc884e , < 3c94212b57bedec3a386ef3da1ef00602f5c3d1d (git) Affected: d47151b79e3220e72ae323b8b8e9d6da20dc884e , < 6acf340f8c1d296bcf535986175f5d0d6f2aab09 (git) Affected: d47151b79e3220e72ae323b8b8e9d6da20dc884e , < e8d6f3ab59468e230f3253efe5cb63efa35289f7 (git) Affected: e05194baae299f2148ab5f6bab659c6ce8d1f6d3 (git) Affected: 5.4.276 , < 5.4.296 (semver) Affected: 5.10.217 , < 5.10.240 (semver) Affected: 5.15.159 , < 5.15.187 (semver) Affected: 6.1.91 , < 6.1.144 (semver) Affected: 6.6.31 , < 6.6.97 (semver) Affected: 6.8.10 , < 6.9 (semver)
Linux	Linux	Affected: 6.9 Unaffected: 0 , < 6.9 (semver) Unaffected: 5.4.296 , ≤ 5.4.* (semver) Unaffected: 5.10.240 , ≤ 5.10.* (semver) Unaffected: 5.15.187 , ≤ 5.15.* (semver) Unaffected: 6.1.144 , ≤ 6.1.* (semver) Unaffected: 6.6.97 , ≤ 6.6.* (semver) Unaffected: 6.12.37 , ≤ 6.12.* (semver) Unaffected: 6.15.6 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:33.631Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:42:00.062Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8785701fd7cd52ae74c0d2b35b82568df74e9dbb",
              "status": "affected",
              "version": "31dd0cda5aa0547de447aaf184812f85ccc34044",
              "versionType": "git"
            },
            {
              "lessThan": "412534a1fb76958b88dca48360c6f3ad4f3390f4",
              "status": "affected",
              "version": "6eef21eb7a165601882dad0419a630e32d2d7a2c",
              "versionType": "git"
            },
            {
              "lessThan": "b92397ce96743e4cc090207e2df2a856cb4cef08",
              "status": "affected",
              "version": "0bbd429260821dfb81478749837d3e6377949ac6",
              "versionType": "git"
            },
            {
              "lessThan": "7701c245ff1ac1a126bf431e72b24547519046ff",
              "status": "affected",
              "version": "9dd86e9d34b1078dcd647220e96a205028bf4e6f",
              "versionType": "git"
            },
            {
              "lessThan": "d0877c479f44fe475f4c8c02c88ce9ad43e90298",
              "status": "affected",
              "version": "53a0365c9f9f66e1a981bf9188d8716d682e0739",
              "versionType": "git"
            },
            {
              "lessThan": "3c94212b57bedec3a386ef3da1ef00602f5c3d1d",
              "status": "affected",
              "version": "d47151b79e3220e72ae323b8b8e9d6da20dc884e",
              "versionType": "git"
            },
            {
              "lessThan": "6acf340f8c1d296bcf535986175f5d0d6f2aab09",
              "status": "affected",
              "version": "d47151b79e3220e72ae323b8b8e9d6da20dc884e",
              "versionType": "git"
            },
            {
              "lessThan": "e8d6f3ab59468e230f3253efe5cb63efa35289f7",
              "status": "affected",
              "version": "d47151b79e3220e72ae323b8b8e9d6da20dc884e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e05194baae299f2148ab5f6bab659c6ce8d1f6d3",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.296",
              "status": "affected",
              "version": "5.4.276",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.240",
              "status": "affected",
              "version": "5.10.217",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.187",
              "status": "affected",
              "version": "5.15.159",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.144",
              "status": "affected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.97",
              "status": "affected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "5.4.276",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "5.10.217",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.187",
                  "versionStartIncluding": "5.15.159",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.144",
                  "versionStartIncluding": "6.1.91",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "6.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.\n\nsyzbot reported a warning below [1] following a fault injection in\nnfs_fs_proc_net_init(). [0]\n\nWhen nfs_fs_proc_net_init() fails, /proc/net/rpc/nfs is not removed.\n\nLater, rpc_proc_exit() tries to remove /proc/net/rpc, and the warning\nis logged as the directory is not empty.\n\nLet\u0027s handle the error of nfs_fs_proc_net_init() properly.\n\n[0]:\nFAULT_INJECTION: forcing a failure.\nname failslab, interval 1, probability 0, space 0, times 0\nCPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\nCall Trace:\n \u003cTASK\u003e\n  dump_stack_lvl (lib/dump_stack.c:123)\n should_fail_ex (lib/fault-inject.c:73 lib/fault-inject.c:174)\n should_failslab (mm/failslab.c:46)\n kmem_cache_alloc_noprof (mm/slub.c:4178 mm/slub.c:4204)\n __proc_create (fs/proc/generic.c:427)\n proc_create_reg (fs/proc/generic.c:554)\n proc_create_net_data (fs/proc/proc_net.c:120)\n nfs_fs_proc_net_init (fs/nfs/client.c:1409)\n nfs_net_init (fs/nfs/inode.c:2600)\n ops_init (net/core/net_namespace.c:138)\n setup_net (net/core/net_namespace.c:443)\n copy_net_ns (net/core/net_namespace.c:576)\n create_new_namespaces (kernel/nsproxy.c:110)\n unshare_nsproxy_namespaces (kernel/nsproxy.c:218 (discriminator 4))\n ksys_unshare (kernel/fork.c:3123)\n __x64_sys_unshare (kernel/fork.c:3190)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \u003c/TASK\u003e\n\n[1]:\nremove_proc_entry: removing non-empty directory \u0027net/rpc\u0027, leaking at least \u0027nfs\u0027\n WARNING: CPU: 1 PID: 6120 at fs/proc/generic.c:727 remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727\nModules linked in:\nCPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\n RIP: 0010:remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727\nCode: 3c 02 00 0f 85 85 00 00 00 48 8b 93 d8 00 00 00 4d 89 f0 4c 89 e9 48 c7 c6 40 ba a2 8b 48 c7 c7 60 b9 a2 8b e8 33 81 1d ff 90 \u003c0f\u003e 0b 90 90 e9 5f fe ff ff e8 04 69 5e ff 90 48 b8 00 00 00 00 00\nRSP: 0018:ffffc90003637b08 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: ffff88805f534140 RCX: ffffffff817a92c8\nRDX: ffff88807da99e00 RSI: ffffffff817a92d5 RDI: 0000000000000001\nRBP: ffff888033431ac0 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000001 R12: ffff888033431a00\nR13: ffff888033431ae4 R14: ffff888033184724 R15: dffffc0000000000\nFS:  0000555580328500(0000) GS:ffff888124a62000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f71733743e0 CR3: 000000007f618000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n  sunrpc_exit_net+0x46/0x90 net/sunrpc/sunrpc_syms.c:76\n  ops_exit_list net/core/net_namespace.c:200 [inline]\n  ops_undo_list+0x2eb/0xab0 net/core/net_namespace.c:253\n  setup_net+0x2e1/0x510 net/core/net_namespace.c:457\n  copy_net_ns+0x2a6/0x5f0 net/core/net_namespace.c:574\n  create_new_namespaces+0x3ea/0xa90 kernel/nsproxy.c:110\n  unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218\n  ksys_unshare+0x45b/0xa40 kernel/fork.c:3121\n  __do_sys_unshare kernel/fork.c:3192 [inline]\n  __se_sys_unshare kernel/fork.c:3190 [inline]\n  __x64_sys_unshare+0x31/0x40 kernel/fork.c:3190\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fa1a6b8e929\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:59:40.599Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8785701fd7cd52ae74c0d2b35b82568df74e9dbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/412534a1fb76958b88dca48360c6f3ad4f3390f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b92397ce96743e4cc090207e2df2a856cb4cef08"
        },
        {
          "url": "https://git.kernel.org/stable/c/7701c245ff1ac1a126bf431e72b24547519046ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0877c479f44fe475f4c8c02c88ce9ad43e90298"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c94212b57bedec3a386ef3da1ef00602f5c3d1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6acf340f8c1d296bcf535986175f5d0d6f2aab09"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8d6f3ab59468e230f3253efe5cb63efa35289f7"
        }
      ],
      "title": "nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38400",
    "datePublished": "2025-07-25T12:53:44.038Z",
    "dateReserved": "2025-04-16T04:51:24.012Z",
    "dateUpdated": "2026-07-14T12:42:00.062Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38401 (GCVE-0-2025-38401)

Vulnerability from cvelistv5 – Published: 2025-07-25 12:53 – Updated: 2026-08-05 12:01

Title

mtk-sd: Prevent memory corruption from DMA map failure

Summary

In the Linux kernel, the following vulnerability has been resolved: mtk-sd: Prevent memory corruption from DMA map failure If msdc_prepare_data() fails to map the DMA region, the request is not prepared for data receiving, but msdc_start_data() proceeds the DMA with previous setting. Since this will lead a memory corruption, we have to stop the request operation soon after the msdc_prepare_data() fails to prepare it.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/5ac9e9e2e9cd6247d…
https://git.kernel.org/stable/c/d54771571f74a82c5…
https://git.kernel.org/stable/c/48bf4f3dfcdab02b2…
https://git.kernel.org/stable/c/63e8953f16acdcb23…
https://git.kernel.org/stable/c/61cdd663564674ea2…
https://git.kernel.org/stable/c/3419bc6a7b65cbbb9…
https://git.kernel.org/stable/c/a5f5f67b284d81776…
https://git.kernel.org/stable/c/f5de469990f195696…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 208489032bdd8d4a7de50f3057c175058f271956 , < 5ac9e9e2e9cd6247d8c2d99780eae4556049e1cc (git) Affected: 208489032bdd8d4a7de50f3057c175058f271956 , < d54771571f74a82c59830a32e76af78a8e57ac69 (git) Affected: 208489032bdd8d4a7de50f3057c175058f271956 , < 48bf4f3dfcdab02b22581d8e350a2d23130b72c0 (git) Affected: 208489032bdd8d4a7de50f3057c175058f271956 , < 63e8953f16acdcb23e2d4dd8a566d3c34df3e200 (git) Affected: 208489032bdd8d4a7de50f3057c175058f271956 , < 61cdd663564674ea21ceb50aa9d3697cbe9e45f9 (git) Affected: 208489032bdd8d4a7de50f3057c175058f271956 , < 3419bc6a7b65cbbb91417bb9970208478e034c79 (git) Affected: 208489032bdd8d4a7de50f3057c175058f271956 , < a5f5f67b284d81776d4a3eb1f8607e4b7f91f11c (git) Affected: 208489032bdd8d4a7de50f3057c175058f271956 , < f5de469990f19569627ea0dd56536ff5a13beaa3 (git)
Linux	Linux	Affected: 4.2 Unaffected: 0 , < 4.2 (semver) Unaffected: 5.4.296 , ≤ 5.4.* (semver) Unaffected: 5.10.240 , ≤ 5.10.* (semver) Unaffected: 5.15.187 , ≤ 5.15.* (semver) Unaffected: 6.1.144 , ≤ 6.1.* (semver) Unaffected: 6.6.97 , ≤ 6.6.* (semver) Unaffected: 6.12.37 , ≤ 6.12.* (semver) Unaffected: 6.15.6 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:35.519Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mmc/host/mtk-sd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5ac9e9e2e9cd6247d8c2d99780eae4556049e1cc",
              "status": "affected",
              "version": "208489032bdd8d4a7de50f3057c175058f271956",
              "versionType": "git"
            },
            {
              "lessThan": "d54771571f74a82c59830a32e76af78a8e57ac69",
              "status": "affected",
              "version": "208489032bdd8d4a7de50f3057c175058f271956",
              "versionType": "git"
            },
            {
              "lessThan": "48bf4f3dfcdab02b22581d8e350a2d23130b72c0",
              "status": "affected",
              "version": "208489032bdd8d4a7de50f3057c175058f271956",
              "versionType": "git"
            },
            {
              "lessThan": "63e8953f16acdcb23e2d4dd8a566d3c34df3e200",
              "status": "affected",
              "version": "208489032bdd8d4a7de50f3057c175058f271956",
              "versionType": "git"
            },
            {
              "lessThan": "61cdd663564674ea21ceb50aa9d3697cbe9e45f9",
              "status": "affected",
              "version": "208489032bdd8d4a7de50f3057c175058f271956",
              "versionType": "git"
            },
            {
              "lessThan": "3419bc6a7b65cbbb91417bb9970208478e034c79",
              "status": "affected",
              "version": "208489032bdd8d4a7de50f3057c175058f271956",
              "versionType": "git"
            },
            {
              "lessThan": "a5f5f67b284d81776d4a3eb1f8607e4b7f91f11c",
              "status": "affected",
              "version": "208489032bdd8d4a7de50f3057c175058f271956",
              "versionType": "git"
            },
            {
              "lessThan": "f5de469990f19569627ea0dd56536ff5a13beaa3",
              "status": "affected",
              "version": "208489032bdd8d4a7de50f3057c175058f271956",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mmc/host/mtk-sd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.187",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.144",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtk-sd: Prevent memory corruption from DMA map failure\n\nIf msdc_prepare_data() fails to map the DMA region, the request is\nnot prepared for data receiving, but msdc_start_data() proceeds\nthe DMA with previous setting.\nSince this will lead a memory corruption, we have to stop the\nrequest operation soon after the msdc_prepare_data() fails to\nprepare it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is the MMC/SD block request path reached through ordinary local file or block-device I/O on the eMMC/SD device; no network or remote peer is involved.\nAC:L - The only precondition is a dma_map_sg() failure, which a local attacker directly induces by exhausting swiotlb bounce buffers, a restricted-dma-pool, or M4U IOVA space with concurrent large O_DIRECT I/O and memory pressure, then reliably lands the corrupt transfer since every subsequent request re-arms the stale BD ring.\nPR:L - Any unprivileged local user can submit MMC requests simply by reading/writing files on the eMMC- or SD-backed filesystem and can generate the DMA-resource pressure needed; no capability or root check exists anywhere on the path.\nUI:N - The corrupt DMA is started by the driver itself as soon as a mapping failure occurs during normal I/O; no victim action is required.\nS:U - The corruption is device DMA into kernel memory managed by the same kernel security authority; no VM, sandbox, or IOMMU translation boundary is crossed.\nC:H - On write transfers the controller streams the contents of stale, already-unmapped and potentially reallocated kernel pages out to the SD/eMMC medium, and the resulting corruption is leverageable for broader kernel memory disclosure.\nI:H - On read transfers the hardware writes attacker-supplied card data into freed/reused kernel memory at stale physical addresses, an uncontrolled kernel write primitive suitable for control-flow hijacking \u2014 the commit itself states this \"will lead a memory corruption\".\nA:H - The mismatched descriptor state triggers DMA protect/checksum errors and data timeouts, and DMA into reallocated kernel memory readily produces oopses and panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:37.420Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5ac9e9e2e9cd6247d8c2d99780eae4556049e1cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/d54771571f74a82c59830a32e76af78a8e57ac69"
        },
        {
          "url": "https://git.kernel.org/stable/c/48bf4f3dfcdab02b22581d8e350a2d23130b72c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/63e8953f16acdcb23e2d4dd8a566d3c34df3e200"
        },
        {
          "url": "https://git.kernel.org/stable/c/61cdd663564674ea21ceb50aa9d3697cbe9e45f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3419bc6a7b65cbbb91417bb9970208478e034c79"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5f5f67b284d81776d4a3eb1f8607e4b7f91f11c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5de469990f19569627ea0dd56536ff5a13beaa3"
        }
      ],
      "title": "mtk-sd: Prevent memory corruption from DMA map failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38401",
    "datePublished": "2025-07-25T12:53:44.961Z",
    "dateReserved": "2025-04-16T04:51:24.012Z",
    "dateUpdated": "2026-08-05T12:01:37.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38403 (GCVE-0-2025-38403)

Vulnerability from cvelistv5 – Published: 2025-07-25 13:08 – Updated: 2026-06-11 18:44

Title

vsock/vmci: Clear the vmci transport packet properly when initializing it

Summary

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: Clear the vmci transport packet properly when initializing it In vmci_transport_packet_init memset the vmci_transport_packet before populating the fields to avoid any uninitialised data being left in the structure.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-10 20:40 UTC

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/19c2cc01ff9a80313…
https://git.kernel.org/stable/c/1c1bcb0e78230f533…
https://git.kernel.org/stable/c/2d44723a091bc8532…
https://git.kernel.org/stable/c/0a01021317375b8d1…
https://git.kernel.org/stable/c/94d0c326cb3ee6b0f…
https://git.kernel.org/stable/c/75705b44e0b9aaa74…
https://git.kernel.org/stable/c/e9a673153d578fd43…
https://git.kernel.org/stable/c/223e2288f4b8c262a…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < 19c2cc01ff9a8031398a802676ffb0f4692dd95d (git) Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < 1c1bcb0e78230f533b4103e8cf271d17c3f469f0 (git) Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < 2d44723a091bc853272e1a51a488a3d22b80be5e (git) Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < 0a01021317375b8d1895152f544421ce49299eb1 (git) Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < 94d0c326cb3ee6b0f8bd00e209550b93fcc5c839 (git) Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < 75705b44e0b9aaa74f4c163d93d388bcba9e386a (git) Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < e9a673153d578fd439919a24e99851b2f87ecbce (git) Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < 223e2288f4b8c262a864e2c03964ffac91744cd5 (git)
Linux	Linux	Affected: 3.9 Unaffected: 0 , < 3.9 (semver) Unaffected: 5.4.296 , ≤ 5.4.* (semver) Unaffected: 5.10.240 , ≤ 5.10.* (semver) Unaffected: 5.15.187 , ≤ 5.15.* (semver) Unaffected: 6.1.144 , ≤ 6.1.* (semver) Unaffected: 6.6.97 , ≤ 6.6.* (semver) Unaffected: 6.12.37 , ≤ 6.12.* (semver) Unaffected: 6.15.6 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:37.415Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38403",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:54.302343Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:06.825Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/vmci_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "19c2cc01ff9a8031398a802676ffb0f4692dd95d",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "1c1bcb0e78230f533b4103e8cf271d17c3f469f0",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "2d44723a091bc853272e1a51a488a3d22b80be5e",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "0a01021317375b8d1895152f544421ce49299eb1",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "94d0c326cb3ee6b0f8bd00e209550b93fcc5c839",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "75705b44e0b9aaa74f4c163d93d388bcba9e386a",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "e9a673153d578fd439919a24e99851b2f87ecbce",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "223e2288f4b8c262a864e2c03964ffac91744cd5",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/vmci_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.187",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.144",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/vmci: Clear the vmci transport packet properly when initializing it\n\nIn vmci_transport_packet_init memset the vmci_transport_packet before\npopulating the fields to avoid any uninitialised data being left in the\nstructure."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:27:18.658Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/19c2cc01ff9a8031398a802676ffb0f4692dd95d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c1bcb0e78230f533b4103e8cf271d17c3f469f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d44723a091bc853272e1a51a488a3d22b80be5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a01021317375b8d1895152f544421ce49299eb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/94d0c326cb3ee6b0f8bd00e209550b93fcc5c839"
        },
        {
          "url": "https://git.kernel.org/stable/c/75705b44e0b9aaa74f4c163d93d388bcba9e386a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9a673153d578fd439919a24e99851b2f87ecbce"
        },
        {
          "url": "https://git.kernel.org/stable/c/223e2288f4b8c262a864e2c03964ffac91744cd5"
        }
      ],
      "title": "vsock/vmci: Clear the vmci transport packet properly when initializing it",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38403",
    "datePublished": "2025-07-25T13:08:09.954Z",
    "dateReserved": "2025-04-16T04:51:24.012Z",
    "dateUpdated": "2026-06-11T18:44:06.825Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38404 (GCVE-0-2025-38404)

Vulnerability from cvelistv5 – Published: 2025-07-25 13:09 – Updated: 2026-05-11 21:27

Title

usb: typec: displayport: Fix potential deadlock

Summary

In the Linux kernel, the following vulnerability has been resolved: usb: typec: displayport: Fix potential deadlock The deadlock can occur due to a recursive lock acquisition of `cros_typec_altmode_data::mutex`. The call chain is as follows: 1. cros_typec_altmode_work() acquires the mutex 2. typec_altmode_vdm() -> dp_altmode_vdm() -> 3. typec_altmode_exit() -> cros_typec_altmode_exit() 4. cros_typec_altmode_exit() attempts to acquire the mutex again To prevent this, defer the `typec_altmode_exit()` call by scheduling it rather than calling it directly from within the mutex-protected context.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/749d9076735fb497a…
https://git.kernel.org/stable/c/eb08fca56f1f39e40…
https://git.kernel.org/stable/c/7be0d1ea71f525954…
https://git.kernel.org/stable/c/76cf1f33e7319fe74…
https://git.kernel.org/stable/c/63cff9f57e86b2dc2…
https://git.kernel.org/stable/c/c782f98eef14197af…
https://git.kernel.org/stable/c/80c25d7916a447153…
https://git.kernel.org/stable/c/099cf1fbb8afc3771…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e0359c66c1beccbe90119a63391678eabda38007 , < 749d9076735fb497aae60fbea9fff563f9ea3254 (git) Affected: e3fb6c2c3939b4aad203cacdd613a62ce1fd032c , < eb08fca56f1f39e4038cb9bac9864464b13b00aa (git) Affected: 56846793f105cf2b39ecbde4f3ae86342091f6fc , < 7be0d1ea71f52595499da39cea484a895e8ed042 (git) Affected: 8e8a69b1f8c59f0505f8a1c0fb77191f27b75011 , < 76cf1f33e7319fe74c94ac92f9814094ee8cc84b (git) Affected: 8851e40587013db00b71d4aeaae30f5fd59b0eec , < 63cff9f57e86b2dc25d7487ca0118df89a665296 (git) Affected: 10cc2cfd3e5d0e0ec7590c4bee8bcea10e5492c4 , < c782f98eef14197affa8a7b91e6981420f109ea9 (git) Affected: 8f6a4fa7b663468bb304cb885b93326e025ae005 , < 80c25d7916a44715338d4f8924c8e52af50d0b9f (git) Affected: b4b38ffb38c91afd4dc387608db26f6fc34ed40b , < 099cf1fbb8afc3771f408109f62bdec66f85160e (git)
Linux	Linux	Affected: 6.1.143 , < 6.1.144 (semver) Affected: 6.6.96 , < 6.6.97 (semver) Affected: 6.12.36 , < 6.12.37 (semver) Affected: 6.15.5 , < 6.15.6 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:39.276Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/altmodes/displayport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "749d9076735fb497aae60fbea9fff563f9ea3254",
              "status": "affected",
              "version": "e0359c66c1beccbe90119a63391678eabda38007",
              "versionType": "git"
            },
            {
              "lessThan": "eb08fca56f1f39e4038cb9bac9864464b13b00aa",
              "status": "affected",
              "version": "e3fb6c2c3939b4aad203cacdd613a62ce1fd032c",
              "versionType": "git"
            },
            {
              "lessThan": "7be0d1ea71f52595499da39cea484a895e8ed042",
              "status": "affected",
              "version": "56846793f105cf2b39ecbde4f3ae86342091f6fc",
              "versionType": "git"
            },
            {
              "lessThan": "76cf1f33e7319fe74c94ac92f9814094ee8cc84b",
              "status": "affected",
              "version": "8e8a69b1f8c59f0505f8a1c0fb77191f27b75011",
              "versionType": "git"
            },
            {
              "lessThan": "63cff9f57e86b2dc25d7487ca0118df89a665296",
              "status": "affected",
              "version": "8851e40587013db00b71d4aeaae30f5fd59b0eec",
              "versionType": "git"
            },
            {
              "lessThan": "c782f98eef14197affa8a7b91e6981420f109ea9",
              "status": "affected",
              "version": "10cc2cfd3e5d0e0ec7590c4bee8bcea10e5492c4",
              "versionType": "git"
            },
            {
              "lessThan": "80c25d7916a44715338d4f8924c8e52af50d0b9f",
              "status": "affected",
              "version": "8f6a4fa7b663468bb304cb885b93326e025ae005",
              "versionType": "git"
            },
            {
              "lessThan": "099cf1fbb8afc3771f408109f62bdec66f85160e",
              "status": "affected",
              "version": "b4b38ffb38c91afd4dc387608db26f6fc34ed40b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/altmodes/displayport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.144",
              "status": "affected",
              "version": "6.1.143",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.97",
              "status": "affected",
              "version": "6.6.96",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.37",
              "status": "affected",
              "version": "6.12.36",
              "versionType": "semver"
            },
            {
              "lessThan": "6.15.6",
              "status": "affected",
              "version": "6.15.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.144",
                  "versionStartIncluding": "6.1.143",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "6.6.96",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "6.12.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "6.15.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: displayport: Fix potential deadlock\n\nThe deadlock can occur due to a recursive lock acquisition of\n`cros_typec_altmode_data::mutex`.\nThe call chain is as follows:\n1. cros_typec_altmode_work() acquires the mutex\n2. typec_altmode_vdm() -\u003e dp_altmode_vdm() -\u003e\n3. typec_altmode_exit() -\u003e cros_typec_altmode_exit()\n4. cros_typec_altmode_exit() attempts to acquire the mutex again\n\nTo prevent this, defer the `typec_altmode_exit()` call by scheduling\nit rather than calling it directly from within the mutex-protected\ncontext."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:27:19.855Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/749d9076735fb497aae60fbea9fff563f9ea3254"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb08fca56f1f39e4038cb9bac9864464b13b00aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/7be0d1ea71f52595499da39cea484a895e8ed042"
        },
        {
          "url": "https://git.kernel.org/stable/c/76cf1f33e7319fe74c94ac92f9814094ee8cc84b"
        },
        {
          "url": "https://git.kernel.org/stable/c/63cff9f57e86b2dc25d7487ca0118df89a665296"
        },
        {
          "url": "https://git.kernel.org/stable/c/c782f98eef14197affa8a7b91e6981420f109ea9"
        },
        {
          "url": "https://git.kernel.org/stable/c/80c25d7916a44715338d4f8924c8e52af50d0b9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/099cf1fbb8afc3771f408109f62bdec66f85160e"
        }
      ],
      "title": "usb: typec: displayport: Fix potential deadlock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38404",
    "datePublished": "2025-07-25T13:09:25.822Z",
    "dateReserved": "2025-04-16T04:51:24.012Z",
    "dateUpdated": "2026-05-11T21:27:19.855Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38406 (GCVE-0-2025-38406)

Vulnerability from cvelistv5 – Published: 2025-07-25 13:13 – Updated: 2026-05-11 21:27

Title

wifi: ath6kl: remove WARN on bad firmware input

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: remove WARN on bad firmware input If the firmware gives bad input, that's nothing to do with the driver's stack at this point etc., so the WARN_ON() doesn't add any value. Additionally, this is one of the top syzbot reports now. Just print a message, and as an added bonus, print the sizes too.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/7a2afdc5af3b82b60…
https://git.kernel.org/stable/c/e6c49f0b203a987c3…
https://git.kernel.org/stable/c/46b47d4b06fa7f234…
https://git.kernel.org/stable/c/89bd133529a4d2d68…
https://git.kernel.org/stable/c/347827bd0c5680dac…
https://git.kernel.org/stable/c/327997afbb5e62532…
https://git.kernel.org/stable/c/27d07deea35ae67f2…
https://git.kernel.org/stable/c/e7417421d89358da0…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < 7a2afdc5af3b82b601f6a2f0d1c90d5f0bc27aeb (git) Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < e6c49f0b203a987c306676d241066451b74db1a5 (git) Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < 46b47d4b06fa7f234d93f0f8ac43798feafcff89 (git) Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < 89bd133529a4d2d68287128b357e49adc00ec690 (git) Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < 347827bd0c5680dac2dd59674616840c4d5154f1 (git) Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < 327997afbb5e62532c28c1861ab5534c01969c9a (git) Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < 27d07deea35ae67f2e75913242e25bdb7e1114e5 (git) Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < e7417421d89358da071fd2930f91e67c7128fbff (git)
Linux	Linux	Affected: 3.2 Unaffected: 0 , < 3.2 (semver) Unaffected: 5.4.296 , ≤ 5.4.* (semver) Unaffected: 5.10.240 , ≤ 5.10.* (semver) Unaffected: 5.15.187 , ≤ 5.15.* (semver) Unaffected: 6.1.144 , ≤ 6.1.* (semver) Unaffected: 6.6.97 , ≤ 6.6.* (semver) Unaffected: 6.12.37 , ≤ 6.12.* (semver) Unaffected: 6.15.6 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:41.135Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath6kl/bmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7a2afdc5af3b82b601f6a2f0d1c90d5f0bc27aeb",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "e6c49f0b203a987c306676d241066451b74db1a5",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "46b47d4b06fa7f234d93f0f8ac43798feafcff89",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "89bd133529a4d2d68287128b357e49adc00ec690",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "347827bd0c5680dac2dd59674616840c4d5154f1",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "327997afbb5e62532c28c1861ab5534c01969c9a",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "27d07deea35ae67f2e75913242e25bdb7e1114e5",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "e7417421d89358da071fd2930f91e67c7128fbff",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath6kl/bmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.187",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.144",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: remove WARN on bad firmware input\n\nIf the firmware gives bad input, that\u0027s nothing to do with\nthe driver\u0027s stack at this point etc., so the WARN_ON()\ndoesn\u0027t add any value. Additionally, this is one of the\ntop syzbot reports now. Just print a message, and as an\nadded bonus, print the sizes too."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:27:22.310Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7a2afdc5af3b82b601f6a2f0d1c90d5f0bc27aeb"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6c49f0b203a987c306676d241066451b74db1a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/46b47d4b06fa7f234d93f0f8ac43798feafcff89"
        },
        {
          "url": "https://git.kernel.org/stable/c/89bd133529a4d2d68287128b357e49adc00ec690"
        },
        {
          "url": "https://git.kernel.org/stable/c/347827bd0c5680dac2dd59674616840c4d5154f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/327997afbb5e62532c28c1861ab5534c01969c9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/27d07deea35ae67f2e75913242e25bdb7e1114e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7417421d89358da071fd2930f91e67c7128fbff"
        }
      ],
      "title": "wifi: ath6kl: remove WARN on bad firmware input",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38406",
    "datePublished": "2025-07-25T13:13:29.646Z",
    "dateReserved": "2025-04-16T04:51:24.012Z",
    "dateUpdated": "2026-05-11T21:27:22.310Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38409 (GCVE-0-2025-38409)

Vulnerability from cvelistv5 – Published: 2025-07-25 13:20 – Updated: 2026-05-11 21:27

Title

drm/msm: Fix another leak in the submit error path

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix another leak in the submit error path put_unused_fd() doesn't free the installed file, if we've already done fd_install(). So we need to also free the sync_file. Patchwork: https://patchwork.freedesktop.org/patch/653583/

Severity

No CVSS data available.

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/00b3401f692082ddf…
https://git.kernel.org/stable/c/c40ad1c04d306f7fd…
https://git.kernel.org/stable/c/3f6ce8433a9035b0a…
https://git.kernel.org/stable/c/30d3819b0b9173e31…
https://git.kernel.org/stable/c/f681c2aa8676a890e…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 , < 00b3401f692082ddf6342500d1be25560bba46d4 (git) Affected: 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 , < c40ad1c04d306f7fde26337fdcf8a5979657d93f (git) Affected: 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 , < 3f6ce8433a9035b0aa810e1f5b708e9dc1c367b0 (git) Affected: 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 , < 30d3819b0b9173e31b84d662a592af8bad351427 (git) Affected: 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 , < f681c2aa8676a890eacc84044717ab0fd26e058f (git)
Linux	Linux	Affected: 3.12 Unaffected: 0 , < 3.12 (semver) Unaffected: 6.1.144 , ≤ 6.1.* (semver) Unaffected: 6.6.97 , ≤ 6.6.* (semver) Unaffected: 6.12.37 , ≤ 6.12.* (semver) Unaffected: 6.15.6 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:42.074Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/msm_gem_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "00b3401f692082ddf6342500d1be25560bba46d4",
              "status": "affected",
              "version": "0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300",
              "versionType": "git"
            },
            {
              "lessThan": "c40ad1c04d306f7fde26337fdcf8a5979657d93f",
              "status": "affected",
              "version": "0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300",
              "versionType": "git"
            },
            {
              "lessThan": "3f6ce8433a9035b0aa810e1f5b708e9dc1c367b0",
              "status": "affected",
              "version": "0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300",
              "versionType": "git"
            },
            {
              "lessThan": "30d3819b0b9173e31b84d662a592af8bad351427",
              "status": "affected",
              "version": "0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300",
              "versionType": "git"
            },
            {
              "lessThan": "f681c2aa8676a890eacc84044717ab0fd26e058f",
              "status": "affected",
              "version": "0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/msm_gem_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.144",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix another leak in the submit error path\n\nput_unused_fd() doesn\u0027t free the installed file, if we\u0027ve already done\nfd_install().  So we need to also free the sync_file.\n\nPatchwork: https://patchwork.freedesktop.org/patch/653583/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:27:25.757Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/00b3401f692082ddf6342500d1be25560bba46d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c40ad1c04d306f7fde26337fdcf8a5979657d93f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f6ce8433a9035b0aa810e1f5b708e9dc1c367b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/30d3819b0b9173e31b84d662a592af8bad351427"
        },
        {
          "url": "https://git.kernel.org/stable/c/f681c2aa8676a890eacc84044717ab0fd26e058f"
        }
      ],
      "title": "drm/msm: Fix another leak in the submit error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38409",
    "datePublished": "2025-07-25T13:20:14.229Z",
    "dateReserved": "2025-04-16T04:51:24.013Z",
    "dateUpdated": "2026-05-11T21:27:25.757Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38410 (GCVE-0-2025-38410)

Vulnerability from cvelistv5 – Published: 2025-07-25 13:20 – Updated: 2026-05-11 21:27

Title

drm/msm: Fix a fence leak in submit error path

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix a fence leak in submit error path In error paths, we could unref the submit without calling drm_sched_entity_push_job(), so msm_job_free() will never get called. Since drm_sched_job_cleanup() will NULL out the s_fence, we can use that to detect this case. Patchwork: https://patchwork.freedesktop.org/patch/653584/

Severity

No CVSS data available.

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/5deab0fa6cfd0cd7d…
https://git.kernel.org/stable/c/201eba5c9652a900c…
https://git.kernel.org/stable/c/fe2695b2f63bd77e0…
https://git.kernel.org/stable/c/0eaa495b3d5710e5b…
https://git.kernel.org/stable/c/0dc817f852e5f8ec8…
https://git.kernel.org/stable/c/5d319f75ccf7f0927…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 , < 5deab0fa6cfd0cd7def17598db15ceb84f950584 (git) Affected: 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 , < 201eba5c9652a900c0b248070263f9acd3735689 (git) Affected: 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 , < fe2695b2f63bd77e0e03bc0fc779164115bb4699 (git) Affected: 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 , < 0eaa495b3d5710e5ba72051d2e01bb28292c625c (git) Affected: 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 , < 0dc817f852e5f8ec8501d19ef7dcc01affa181d0 (git) Affected: 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 , < 5d319f75ccf7f0927425a7545aa1a22b3eedc189 (git)
Linux	Linux	Affected: 3.12 Unaffected: 0 , < 3.12 (semver) Unaffected: 5.15.187 , ≤ 5.15.* (semver) Unaffected: 6.1.144 , ≤ 6.1.* (semver) Unaffected: 6.6.97 , ≤ 6.6.* (semver) Unaffected: 6.12.37 , ≤ 6.12.* (semver) Unaffected: 6.15.6 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:43.099Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/msm_gem_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5deab0fa6cfd0cd7def17598db15ceb84f950584",
              "status": "affected",
              "version": "0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300",
              "versionType": "git"
            },
            {
              "lessThan": "201eba5c9652a900c0b248070263f9acd3735689",
              "status": "affected",
              "version": "0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300",
              "versionType": "git"
            },
            {
              "lessThan": "fe2695b2f63bd77e0e03bc0fc779164115bb4699",
              "status": "affected",
              "version": "0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300",
              "versionType": "git"
            },
            {
              "lessThan": "0eaa495b3d5710e5ba72051d2e01bb28292c625c",
              "status": "affected",
              "version": "0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300",
              "versionType": "git"
            },
            {
              "lessThan": "0dc817f852e5f8ec8501d19ef7dcc01affa181d0",
              "status": "affected",
              "version": "0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300",
              "versionType": "git"
            },
            {
              "lessThan": "5d319f75ccf7f0927425a7545aa1a22b3eedc189",
              "status": "affected",
              "version": "0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/msm_gem_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.187",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.144",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix a fence leak in submit error path\n\nIn error paths, we could unref the submit without calling\ndrm_sched_entity_push_job(), so msm_job_free() will never get\ncalled.  Since drm_sched_job_cleanup() will NULL out the\ns_fence, we can use that to detect this case.\n\nPatchwork: https://patchwork.freedesktop.org/patch/653584/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:27:26.984Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5deab0fa6cfd0cd7def17598db15ceb84f950584"
        },
        {
          "url": "https://git.kernel.org/stable/c/201eba5c9652a900c0b248070263f9acd3735689"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe2695b2f63bd77e0e03bc0fc779164115bb4699"
        },
        {
          "url": "https://git.kernel.org/stable/c/0eaa495b3d5710e5ba72051d2e01bb28292c625c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dc817f852e5f8ec8501d19ef7dcc01affa181d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d319f75ccf7f0927425a7545aa1a22b3eedc189"
        }
      ],
      "title": "drm/msm: Fix a fence leak in submit error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38410",
    "datePublished": "2025-07-25T13:20:15.184Z",
    "dateReserved": "2025-04-16T04:51:24.013Z",
    "dateUpdated": "2026-05-11T21:27:26.984Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38412 (GCVE-0-2025-38412)

Vulnerability from cvelistv5 – Published: 2025-07-25 13:20 – Updated: 2026-08-05 12:01

Title

platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks

Summary

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks After retrieving WMI data blocks in sysfs callbacks, check for the validity of them before dereferencing their content.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/92c2d914b5337431d…
https://git.kernel.org/stable/c/68e9963583d11963c…
https://git.kernel.org/stable/c/0deb3eb78ebf225cb…
https://git.kernel.org/stable/c/5df3b870bc389a176…
https://git.kernel.org/stable/c/aaf847dcb4114fe8b…
https://git.kernel.org/stable/c/eb617dd25ca176f3f…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e8a60aa7404bfef37705da5607c97737073ac38d , < 92c2d914b5337431d885597a79a3a3d9d55e80b7 (git) Affected: e8a60aa7404bfef37705da5607c97737073ac38d , < 68e9963583d11963ceca5d276e9c44684509f759 (git) Affected: e8a60aa7404bfef37705da5607c97737073ac38d , < 0deb3eb78ebf225cb41aa9b2b2150f46cbfd359e (git) Affected: e8a60aa7404bfef37705da5607c97737073ac38d , < 5df3b870bc389a1767c72448a3ce1c576ef4deab (git) Affected: e8a60aa7404bfef37705da5607c97737073ac38d , < aaf847dcb4114fe8b25d4c1c790bedcb6088cb3d (git) Affected: e8a60aa7404bfef37705da5607c97737073ac38d , < eb617dd25ca176f3fee24f873f0fd60010773d67 (git)
Linux	Linux	Affected: 5.11 Unaffected: 0 , < 5.11 (semver) Unaffected: 5.15.187 , ≤ 5.15.* (semver) Unaffected: 6.1.144 , ≤ 6.1.* (semver) Unaffected: 6.6.97 , ≤ 6.6.* (semver) Unaffected: 6.12.37 , ≤ 6.12.* (semver) Unaffected: 6.15.6 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:44.050Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h",
            "drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c",
            "drivers/platform/x86/dell/dell-wmi-sysman/int-attributes.c",
            "drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c",
            "drivers/platform/x86/dell/dell-wmi-sysman/string-attributes.c",
            "drivers/platform/x86/dell/dell-wmi-sysman/sysman.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "92c2d914b5337431d885597a79a3a3d9d55e80b7",
              "status": "affected",
              "version": "e8a60aa7404bfef37705da5607c97737073ac38d",
              "versionType": "git"
            },
            {
              "lessThan": "68e9963583d11963ceca5d276e9c44684509f759",
              "status": "affected",
              "version": "e8a60aa7404bfef37705da5607c97737073ac38d",
              "versionType": "git"
            },
            {
              "lessThan": "0deb3eb78ebf225cb41aa9b2b2150f46cbfd359e",
              "status": "affected",
              "version": "e8a60aa7404bfef37705da5607c97737073ac38d",
              "versionType": "git"
            },
            {
              "lessThan": "5df3b870bc389a1767c72448a3ce1c576ef4deab",
              "status": "affected",
              "version": "e8a60aa7404bfef37705da5607c97737073ac38d",
              "versionType": "git"
            },
            {
              "lessThan": "aaf847dcb4114fe8b25d4c1c790bedcb6088cb3d",
              "status": "affected",
              "version": "e8a60aa7404bfef37705da5607c97737073ac38d",
              "versionType": "git"
            },
            {
              "lessThan": "eb617dd25ca176f3fee24f873f0fd60010773d67",
              "status": "affected",
              "version": "e8a60aa7404bfef37705da5607c97737073ac38d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h",
            "drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c",
            "drivers/platform/x86/dell/dell-wmi-sysman/int-attributes.c",
            "drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c",
            "drivers/platform/x86/dell/dell-wmi-sysman/string-attributes.c",
            "drivers/platform/x86/dell/dell-wmi-sysman/sysman.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.187",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.144",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks\n\nAfter retrieving WMI data blocks in sysfs callbacks, check for the\nvalidity of them before dereferencing their content."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through a sysfs file read on the local machine (`/sys/class/firmware-attributes/dell-wmi-sysman/...`), which requires local access to the system. There is no network, adjacent-network, or physical-only path to `is_enabled_show()`/`current_value_show()`.\nAC:L - On an affected Dell/Alienware system whose firmware returns a non-package or short WMI data block, a single `cat` of the sysfs file deterministically and repeatably hits the unvalidated dereference \u2014 no race to win, no memory-layout grooming, and no state the attacker must wait for. The attack can be repeated arbitrarily to re-trigger the fault or harvest additional leaked bytes.\nPR:L - `passobj-attributes.c` exposes `is_enabled` via `__ATTR_RO()`, i.e. mode 0444, so any unprivileged local user can read it and drive `is_enabled_show()` into the unchecked `obj-\u003epackage.elements[IS_PASS_SET]` dereference; only a basic user account is needed, not root.\nUI:N - The attacker performs the triggering read themselves via an ordinary open()/read() on the world-readable sysfs attribute. No victim action, no privileged helper, and no administrator interaction is required.\nS:U - The out-of-bounds read, wild-pointer dereference, and any resulting crash all occur inside the kernel of the same system, managed by the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The type confusion turns a firmware-supplied 64-bit value (or a string/buffer data pointer) into the `elements` array base, yielding an out-of-bounds \u2014 effectively arbitrary-address \u2014 kernel read whose result is then formatted with `snprintf(\"%s\"/\"%lld\")` straight into the sysfs buffer returned to userspace. Because the vulnerable `is_enabled` attribute is world-readable, an unprivileged user obtains a repeatable kernel memory disclosure primitive.\nI:H - This is a genuine type confusion \u2014 a `union acpi_object` of type Integer/String/Buffer is interpreted as a Package, so an attacker-influencable firmware value is consumed as a kernel pointer and indexed. Per the type-confusion classification, and given that a firmware-controlled pointer dereference in a driver that also performs BIOS attribute and password-object operations undermines the integrity of the kernel\u0027s view of that data, this is scored High.\nA:H - Dereferencing the confused `elements` pointer (an arbitrary firmware integer, or an out-of-bounds address past a buffer/short package) reliably produces an unhandled page fault and kernel oops/panic, and the subsequent `%s` dereference of an out-of-bounds `string.pointer` compounds this. Any local user can trigger it on demand by reading the 0444 `is_enabled` file, making it a repeatable full denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:41.721Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/92c2d914b5337431d885597a79a3a3d9d55e80b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/68e9963583d11963ceca5d276e9c44684509f759"
        },
        {
          "url": "https://git.kernel.org/stable/c/0deb3eb78ebf225cb41aa9b2b2150f46cbfd359e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5df3b870bc389a1767c72448a3ce1c576ef4deab"
        },
        {
          "url": "https://git.kernel.org/stable/c/aaf847dcb4114fe8b25d4c1c790bedcb6088cb3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb617dd25ca176f3fee24f873f0fd60010773d67"
        }
      ],
      "title": "platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38412",
    "datePublished": "2025-07-25T13:20:16.688Z",
    "dateReserved": "2025-04-16T04:51:24.013Z",
    "dateUpdated": "2026-08-05T12:01:41.721Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CERTFR-2025-AVI-0698

Solutions

CVE-2025-38396 (GCVE-0-2025-38396)

CVE-2025-38399 (GCVE-0-2025-38399)

CVE-2025-38400 (GCVE-0-2025-38400)

CVE-2025-38401 (GCVE-0-2025-38401)

CVE-2025-38403 (GCVE-0-2025-38403)

CVE-2025-38404 (GCVE-0-2025-38404)

CVE-2025-38406 (GCVE-0-2025-38406)

CVE-2025-38409 (GCVE-0-2025-38409)

CVE-2025-38410 (GCVE-0-2025-38410)

CVE-2025-38412 (GCVE-0-2025-38412)

Tags

Sightings

Nomenclature