CVE-2025-38216
BaseFortify
Publication date: 2025-07-04
Last updated on: 2025-11-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a regression in the Linux kernel's iommu/vt-d subsystem caused by a change in how context entries are set up during domain attachment. The change switched from a set-and-check policy to a clear-and-reset approach, which inadvertently broke support for PCI aliased devices behind PCIe-to-PCI bridges. As a result, certain devices like keyboards and touchpads on some Apple Macbooks stopped working, generating DMA read faults and device errors. The fix involved restoring the previous context setup order to resolve these issues.
How can this vulnerability impact me? :
This vulnerability can cause hardware devices such as keyboards and touchpads on affected Apple Macbooks to stop functioning properly. Users may experience input device failures and related error messages in the kernel logs, potentially impacting usability and system functionality on affected hardware configurations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking system logs for specific error messages related to PCI aliased devices and IOMMU faults. Look for kernel log entries indicating DMA read faults and errors writing to Apple SPI devices, such as messages containing 'DMAR: DRHD: handling fault status reg 3', 'DMA Read NO_PASID', and 'Error writing to device'. Commands like 'dmesg | grep -i DMAR' or 'journalctl -k | grep -i DMAR' can help identify these errors.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to apply the patch that restores the previous context entry setup order for aliased devices in the Linux kernel. This fix addresses the regression introduced by commit 2031c469f816. Until the patch is applied, affected devices such as keyboards and touchpads on certain Apple Macbooks may not function correctly.