CVE-2025-38422
BaseFortify
Publication date: 2025-07-25
Last updated on: 2025-12-23
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 4.19 (inc) to 6.1.142 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.95 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.35 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.15.4 (exc) |
| debian | debian_linux | 11.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the Linux kernel's network driver for PCI1xxxx devices (lan743x). It relates to incorrect definitions of the maximum sizes for EEPROM and OTP memory areas, which could lead to out-of-bound read or write operations. The fix adjusts the maximum size definitions and ensures the correct EEPROM length is returned based on the device, preventing these out-of-bound memory accesses.
How can this vulnerability impact me? :
The vulnerability could allow out-of-bound read or write operations on the EEPROM or OTP memory of affected PCI1xxxx devices, potentially leading to system instability, data corruption, or security issues such as unauthorized memory access.