CVE-2025-38082 (GCVE-0-2025-38082)
Vulnerability from cvelistv5 – Published: 2025-06-18 09:35 – Updated: 2026-08-05 11:59
VLAI
EPSS
VEX
Title
gpio: virtuser: fix potential out-of-bound write
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpio: virtuser: fix potential out-of-bound write
If the caller wrote more characters, count is truncated to the max
available space in "simple_write_to_buffer". Check that the input
size does not exceed the buffer size. Write a zero termination
afterwards.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
91581c4b3f29e2e22aeb1a62e842d529ca638b2d , < afe090366f470f77e140ff3407db813f57852c04
(git)
Affected: 91581c4b3f29e2e22aeb1a62e842d529ca638b2d , < b96feaaa0fda1e3871b438143c3446954b32d3a7 (git) Affected: 91581c4b3f29e2e22aeb1a62e842d529ca638b2d , < 7118be7c6072f40391923543fdd1563b8d56377c (git) |
guessed | |
| Linux | Linux |
Affected:
6.11
Unaffected: 0 , < 6.11 (semver) Unaffected: 6.12.32 , ≤ 6.12.* (semver) Unaffected: 6.14.10 , ≤ 6.14.* (semver) Unaffected: 6.15 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-virtuser.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "afe090366f470f77e140ff3407db813f57852c04",
"status": "affected",
"version": "91581c4b3f29e2e22aeb1a62e842d529ca638b2d",
"versionType": "git"
},
{
"lessThan": "b96feaaa0fda1e3871b438143c3446954b32d3a7",
"status": "affected",
"version": "91581c4b3f29e2e22aeb1a62e842d529ca638b2d",
"versionType": "git"
},
{
"lessThan": "7118be7c6072f40391923543fdd1563b8d56377c",
"status": "affected",
"version": "91581c4b3f29e2e22aeb1a62e842d529ca638b2d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-virtuser.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.14.*",
"status": "unaffected",
"version": "6.14.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.32",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14.10",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: virtuser: fix potential out-of-bound write\n\nIf the caller wrote more characters, count is truncated to the max\navailable space in \"simple_write_to_buffer\". Check that the input\nsize does not exceed the buffer size. Write a zero termination\nafterwards."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via a `write(2)`/`pwrite(2)` syscall on the local debugfs files `/sys/kernel/debug/gpio-virtuser/\u003cdev\u003e/\u003cline\u003e/direction` and `.../consumer`. There is no network, remote-peer, or over-the-air input path into the gpio-virtuser driver.\nAC:L - A single unconditional write triggers it deterministically \u2014 a 32-byte write to `direction` guarantees an unterminated buffer and a one-byte OOB store past `buf[32]`, and a zero-length write to `consumer` guarantees `buf[strlen(buf)-1]` evaluates to `buf[-1]` on default `INIT_STACK_ALL_ZERO` kernels. There is no race, no timing window, and no memory-layout precondition outside the attacker\u0027s influence, since the attacker controls both the write length and every byte.\nPR:L - The debugfs nodes are mode 0644 and debugfs defaults to a 0700 root, but the `uid=`/`gid=`/`mode=` mount options and vendor chown policies commonly delegate debugfs to non-root system accounts on the embedded/industrial/automotive boards where a GPIO test-consumer device is instantiated, so a low-privileged local account is the realistic worst case \u2014 consistent with prior kernel CNA debugfs scoring (CVE-2025-38317, CVE-2025-38307).\nUI:N - The attacker performs the write entirely on their own; no victim action, mount, or file-open by another user is required.\nS:U - The corruption and disclosure occur in kernel stack/heap memory within the same kernel security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - `strim()` and `strlen()` read out of bounds past the stack buffer, and the unterminated buffer is handed to `gpiod_set_consumer_name()` \u2192 `desc_set_label()`, which `strcpy()`s the out-of-bounds stack bytes into a label exported to userspace through the debugfs `consumer` read and `GPIO_V2_GET_LINEINFO_IOCTL`; a `pwrite` at offset 31 leaks up to 31 bytes of uninitialized kernel stack, which can contain pointers and defeat KASLR.\nI:H - This is an out-of-bounds write \u2014 a NUL byte stored past the end of `buf[32]` in `direction`, and below the array (`buf[-1]`) or beyond it in `consumer` \u2014 at an offset the attacker can influence by grooming the kernel stack with prior syscalls, yielding a classic poison-NUL-byte primitive able to truncate an adjacent saved pointer or length field into a control-flow hijack.\nA:H - Corrupting adjacent stack locals, the stack-protector canary, or the frame of neighboring calls produces `__stack_chk_fail()` panics or oopses, and the OOB `strlen()` walk can fault; the attacker can repeat the write at will to guarantee a crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:59:20.241Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/afe090366f470f77e140ff3407db813f57852c04"
},
{
"url": "https://git.kernel.org/stable/c/b96feaaa0fda1e3871b438143c3446954b32d3a7"
},
{
"url": "https://git.kernel.org/stable/c/7118be7c6072f40391923543fdd1563b8d56377c"
}
],
"title": "gpio: virtuser: fix potential out-of-bound write",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38082",
"datePublished": "2025-06-18T09:35:41.902Z",
"dateReserved": "2025-04-16T04:51:23.981Z",
"dateUpdated": "2026-08-05T11:59:20.241Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-38082",
"date": "2026-11-13",
"epss": "0.00177",
"percentile": "0.07369"
},
"microsoft_vex": {
"current_release_date": "2025-09-04T01:55:27.000Z",
"cve": "CVE-2025-38082",
"id": "msrc_CVE-2025-38082",
"initial_release_date": "2025-06-02T00:00:00.000Z",
"product_status:under_investigation": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "gpio: virtuser: fix potential out-of-bound write",
"url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38082.json",
"version": "1"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-virtuser.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "afe090366f470f77e140ff3407db813f57852c04",
"status": "affected",
"version": "91581c4b3f29e2e22aeb1a62e842d529ca638b2d",
"versionType": "git"
},
{
"lessThan": "b96feaaa0fda1e3871b438143c3446954b32d3a7",
"status": "affected",
"version": "91581c4b3f29e2e22aeb1a62e842d529ca638b2d",
"versionType": "git"
},
{
"lessThan": "7118be7c6072f40391923543fdd1563b8d56377c",
"status": "affected",
"version": "91581c4b3f29e2e22aeb1a62e842d529ca638b2d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-virtuser.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.14.*",
"status": "unaffected",
"version": "6.14.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4A0B0CEE-D47B-434F-86D9-03E1CFBEF1AD",
"versionEndExcluding": "6.12.32",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DB4249FA-EF24-4488-A579-B8E8EE87EA6F",
"versionEndExcluding": "6.14.10",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*",
"matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*",
"matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*",
"matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*",
"matchCriteriaId": "2D240580-3048-49B2-9E27-F115A9DF8224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*",
"matchCriteriaId": "90320558-E553-4EF5-8A0B-0F5D20113BD2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: virtuser: fix potential out-of-bound write\n\nIf the caller wrote more characters, count is truncated to the max\navailable space in \"simple_write_to_buffer\". Check that the input\nsize does not exceed the buffer size. Write a zero termination\nafterwards."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: gpio: virtuser: correcci\u00f3n de una posible escritura fuera de l\u00edmite. Si el llamador escribi\u00f3 m\u00e1s caracteres, el recuento se trunca al espacio m\u00e1ximo disponible en \"simple_write_to_buffer\". Compruebe que el tama\u00f1o de entrada no supere el tama\u00f1o del b\u00fafer. Escriba una terminaci\u00f3n de cero despu\u00e9s."
}
],
"id": "CVE-2025-38082",
"lastModified": "2026-07-30T06:22:49.067",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-06-18T10:15:41.890",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/7118be7c6072f40391923543fdd1563b8d56377c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/afe090366f470f77e140ff3407db813f57852c04"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/b96feaaa0fda1e3871b438143c3446954b32d3a7"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Low",
"current_release_date": "2026-11-09T18:27:03+00:00",
"cve": "CVE-2025-38082",
"id": "CVE-2025-38082",
"initial_release_date": "2025-06-18T00:00:00+00:00",
"product_status:known_not_affected": "200",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: gpio: virtuser: fix potential out-of-bound write",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38082.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.