CVE-2025-38004
BaseFortify
Publication date: 2025-06-08
Last updated on: 2025-12-17
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 2.6.25 (inc) to 5.4.294 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.238 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.185 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.141 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.93 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.31 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.14.9 (exc) |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| debian | debian_linux | 11.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's CAN broadcast manager (CAN BCM). It involves unsafe updates to the 'currframe' counter and the 'count' variable during runtime, which can be triggered from both user space and hrtimer context in the bcm_can_tx() function. This can lead to a slab-out-of-bounds read access, a type of memory error, which was demonstrated by a proof of concept. The issue was resolved by adding proper locking mechanisms (spin_lock_bh) to protect these updates.
How can this vulnerability impact me? :
The vulnerability can lead to a slab-out-of-bounds read access in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker to read unauthorized memory. This could affect the reliability and security of systems using the CAN BCM feature in the Linux kernel.
What immediate steps should I take to mitigate this vulnerability?
Apply the patch that adds locking for bcm_op runtime updates in the Linux kernel CAN BCM subsystem to prevent concurrent modifications causing slab-out-of-bounds read access. Specifically, ensure your Linux kernel is updated to a version that includes the fix which adds spin_lock_bh protection around bcm_can_tx() operations.