CVE-2025-38538: vulnerability in Linux
dmaengine: nbpfaxi: Fix memory corruption in probe()
Published · Updated
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.2%
exploitation probability
0.2%top 93% of all CVEs
observed exploitation
nono source reports it
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: nbpfaxi: Fix memory corruption in probe()
The nbpf->chan[] array is allocated earlier in the nbpf_probe() function
and it has "num_channels" elements. These three loops iterate one
element farther than they should and corrupt memory.
The changes to the second loop are more involved. In this case, we're
copying data from the irqbuf[] array into the nbpf->chan[] array. If
the data in irqbuf[i] is the error IRQ then we skip it, so the iterators
are not in sync. I added a check to ensure that we don't go beyond the
end of the irqbuf[] array. I'm pretty sure this can't happen, but it
seemed harmless to add a check.
On the other hand, after the loop has ended there is a check to ensure
that the "chan" iterator is where we expect it to be. In the original
code we went one element beyond the end of the array so the iterator
wasn't in the correct place and it would always return -EINVAL. However,
now it will always be in the correct place. I deleted the check since
we know the result.
Affected products
Linux · LinuxRelated CVEs — Linux
In the same product, most dangerous first.
CVE-2024-53197HIGHALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devicesEPSS 4.1%KEVCVE-2026-31431HIGHcrypto: algif_aead - Revert to operating out-of-placeEPSS 3.4%KEVCVE-2024-53104HIGHmedia: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_formatEPSS 3.4%KEVCVE-2025-39682CRITICALtls: fix handling of zero-length records on the rx_listEPSS 2.9%KEVCVE-2024-36971HIGHnet: fix __dst_negative_advice() raceEPSS 2.7%KEVCVE-2025-39964HIGHcrypto: af_alg - Disallow concurrent writes in af_alg_sendmsgEPSS 1.4%KEV
References
https://git.kernel.org/stable/c/122160289adf8ebf15060f1cbf6265b55a914948https://git.kernel.org/stable/c/188c6ba1dd925849c5d94885c8bbdeb0b3dcf510https://git.kernel.org/stable/c/24861ef8b517a309a4225f2793be0cd8fa0bec9ehttps://git.kernel.org/stable/c/4bb016438335ec02b01f96bf1367378c2bfe03e5https://git.kernel.org/stable/c/84fff8e6f11b9af1407e273995b5257d99ff0cffhttps://git.kernel.org/stable/c/aec396b4f736f3f8d2c28a9cd2924a4ada57ae87https://git.kernel.org/stable/c/d6bbd67ab5de37a74ac85c83c5a26664b62034ddhttps://git.kernel.org/stable/c/f366b36c5e3ce29c9a3c8eed3d1631908e4fc8bbhttps://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlhttps://lists.debian.org/debian-lts-announce/2025/10/msg00008.html