CVE-2025-38003
BaseFortify
Publication date: 2025-06-08
Last updated on: 2025-12-17
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 4.19.252 (inc) to 4.20 (exc) |
| linux | linux_kernel | From 5.4.205 (inc) to 5.4.294 (exc) |
| linux | linux_kernel | From 5.10.130 (inc) to 5.10.238 (exc) |
| linux | linux_kernel | From 5.15.54 (inc) to 5.15.185 (exc) |
| linux | linux_kernel | From 5.18.11 (inc) to 5.19 (exc) |
| linux | linux_kernel | From 5.19.1 (inc) to 6.1.141 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.93 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.31 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.14.9 (exc) |
| linux | linux_kernel | 5.19 |
| linux | linux_kernel | 5.19 |
| linux | linux_kernel | 5.19 |
| linux | linux_kernel | 5.19 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| debian | debian_linux | 11.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is in the Linux kernel's CAN subsystem for Broadcom (bcm). It occurs because the procfs content generation for a bcm_op object that is being removed lacks proper RCU (Read-Copy-Update) read protection. This can cause the procfs output to show unreliable data due to a use-after-free (UAF) condition. The issue is fixed by adding the missing rcu_read_lock() to ensure safe access and proper removal of list entries under RCU protection.
How can this vulnerability impact me? :
The vulnerability can cause the procfs interface to display unreliable or stale data due to a use-after-free condition when accessing bcm_op objects being removed. This could potentially lead to system instability or incorrect information being presented to users or monitoring tools that rely on procfs data.