CVE-2025-38538 Information

Aug 17, 2025 cve

Description

In the Linux kernel the following vulnerability has been resolved:

dmaengine: nbpfaxi: Fix memory corruption in probe()

The nbpf->chan[] array is allocated earlier in the nbpf_probe() function and it has um_channels\ elements. These three loops iterate one element farther than they should and corrupt memory.

The changes to the second loop are more involved. In this case we’re copying data from the irqbuf[] array into the nbpf->chan[] array. If the data in irqbuf[i] is the error IRQ then we skip it so the iterators are not in sync. I added a check to ensure that we don’t go beyond the end of the irqbuf[] array. I’m pretty sure this can’t happen but it seemed harmless to add a check.

On the other hand after the loop has ended there is a check to ensure that the ## Reference https://git.kernel.org/stable/c/122160289adf8ebf15060f1cbf6265b55a914948 https://git.kernel.org/stable/c/188c6ba1dd925849c5d94885c8bbdeb0b3dcf510 https://git.kernel.org/stable/c/4bb016438335ec02b01f96bf1367378c2bfe03e5 https://git.kernel.org/stable/c/d6bbd67ab5de37a74ac85c83c5a26664b62034dd https://git.kernel.org/stable/c/f366b36c5e3ce29c9a3c8eed3d1631908e4fc8bb

CNNVD-202508-1957 (Published: 2025-08-16)

Share on: