CVE-2025-38398
BaseFortify
Publication date: 2025-07-25
Last updated on: 2025-11-19
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is in the Linux kernel's spi-qpic-snand driver. It occurs because the driver initially allocates memory for BAM transactions based on an assumed number of 'codewords' (units related to NAND chip page size), but this initial allocation is too small. When the actual number of codewords is larger, the driver accesses memory beyond the allocated range, causing out-of-bounds memory access. This leads to memory corruption, which can cause errors such as buffer mapping failures, write failures, and kernel panics due to NULL pointer dereferences or bad spinlock states.
How can this vulnerability impact me? :
This vulnerability can cause system instability and crashes. Specifically, it can lead to kernel panics during device reboot due to memory corruption, resulting in NULL pointer dereferences or spinlock errors. This can cause unexpected system reboots or failures, potentially leading to data loss or service interruptions on affected devices using the vulnerable driver.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for specific error messages related to the qcom_snand driver. Look for messages such as 'swiotlb buffer is full', 'failure in mapping desc', 'failure to write raw page', 'write_oob failed (-110)', or kernel panics related to 'spinlock bad magic' or 'kernel paging request'. Commands like 'dmesg | grep qcom_snand' or 'journalctl -k | grep qcom_snand' can help identify these symptoms.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the qcom_snand driver properly reallocates BAM transactions memory after determining the actual number of codewords required. This prevents out-of-bounds memory access. Until an update is applied, avoid using the affected driver or the mtd_nandbiterrs module for testing, and monitor for related kernel errors to prevent system panics.