CVE-2025-38042
BaseFortify
Publication date: 2025-06-18
Last updated on: 2025-11-14
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the Linux kernel's dmaengine driver for Texas Instruments hardware, specifically the ti_am65_cpsw_nuss driver. The issue was that the function k3_udma_glue_reset_rx_chn() relied on a skip_fdq argument provided by the user to determine how to reset the RX channel's flow descriptor queues (FDQs). Different platforms have different DMA architectures, some with a single FDQ for all flows and others with separate FDQs per flow. Relying on the user to provide this information could cause incorrect handling of FDQs, leading to potential kernel warnings or errors. The fix removes the skip_fdq argument and instead infers the correct behavior internally based on the DMA architecture, improving stability and correctness.
How can this vulnerability impact me? :
This vulnerability can cause kernel warnings and errors related to descriptor pool sizes and improper handling of DMA RX channel flow descriptor queues. This may lead to instability or crashes when managing network interfaces on affected Texas Instruments platforms using the ti_am65_cpsw_nuss driver, especially during operations like bringing interfaces down or changing RX queue settings. Such instability could disrupt network connectivity or system operation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing kernel logs for specific warning messages related to the ti_am65_cpsw_nuss driver and k3_cppi_desc_pool. For example, after performing network interface operations such as bringing interfaces down and up or changing RX queue settings, check dmesg for warnings like 'k3_knav_desc_pool size 512000 != avail 64000' and call traces involving k3_cppi_desc_pool_destroy and ti_am65_cpsw_nuss. Suggested commands include: 1. ip link set eth1 down 2. ip link set eth0 down 3. ethtool -L eth0 rx 8 4. ip link set eth0 up 5. dmesg | grep -i k3_cppi_desc_pool These steps replicate the conditions that trigger the issue and allow detection via kernel log inspection.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the vulnerability is fixed. The fix involves dropping the skip_fdq argument from k3_udma_glue_reset_rx_chn and inferring the FDQ configuration internally to prevent improper clearing of descriptor pools. Until the patch is applied, avoid operations that reset RX channels on affected drivers (such as ti_am65_cpsw_nuss) or unload the module, as these can trigger the issue. Monitoring kernel logs for warnings and avoiding module reloads can help reduce impact.