cbcvebase.
CVE-2025-38090
published 2025-06-30

CVE-2025-38090: In the Linux kernel, the following vulnerability has been resolved: drivers/rapidio/rio_cm.c: prevent possible heap overwrite In…

medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
In the Linux kernel, the following vulnerability has been resolved: drivers/rapidio/rio_cm.c: prevent possible heap overwrite In riocm_cdev_ioctl(RIO_CM_CHAN_SEND) -> cm_chan_msg_send() -> riocm_ch_send() cm_chan_msg_send() checks that userspace didn't send too much data but riocm_ch_send() failed to check that userspace sent sufficient data. The result is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr which were outside the bounds of the space which cm_chan_msg_send() allocated. Address this by teaching riocm_ch_send() to check that the entire rio_ch_chan_hdr was copied in from userspace.

Affected

37 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.147-1 (bookworm)linux 6.1.147-1 (bookworm)
debianlinux-6.1< linux 6.1.147-1 (bookworm)linux 6.1.147-1 (bookworm)
linuxlinux
linuxlinux>= b6e8d4aa1110306378af0f3472a6b85a1f039a16 < a8b5ea2e302aa5cd00fc7addd8df53c9bde7b5f6a8b5ea2e302aa5cd00fc7addd8df53c9bde7b5f6
linuxlinux>= b6e8d4aa1110306378af0f3472a6b85a1f039a16 < c03ddc183249f03fc7e057e02cae6f89144d0123c03ddc183249f03fc7e057e02cae6f89144d0123
linuxlinux>= b6e8d4aa1110306378af0f3472a6b85a1f039a16 < 58f664614f8c3d6142ab81ae551e466dc6e092e858f664614f8c3d6142ab81ae551e466dc6e092e8
linuxlinux>= b6e8d4aa1110306378af0f3472a6b85a1f039a16 < ecf5ee280b702270afb02f61b299d3dfe3ec7730ecf5ee280b702270afb02f61b299d3dfe3ec7730
linuxlinux>= b6e8d4aa1110306378af0f3472a6b85a1f039a16 < 1921781ec4a8824bd0c520bf9363e28a880d14ec1921781ec4a8824bd0c520bf9363e28a880d14ec
linuxlinux>= b6e8d4aa1110306378af0f3472a6b85a1f039a16 < 1cce6ac47f4a2ac1766b8a188dc8c8f6d8df2a531cce6ac47f4a2ac1766b8a188dc8c8f6d8df2a53
linuxlinux>= b6e8d4aa1110306378af0f3472a6b85a1f039a16 < 6d5c6711a55c35ce09b90705546050408d9d4b616d5c6711a55c35ce09b90705546050408d9d4b61
linuxlinux>= b6e8d4aa1110306378af0f3472a6b85a1f039a16 < 50695153d7ddde3b1696dbf0085be0033bf3ddb350695153d7ddde3b1696dbf0085be0033bf3ddb3
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.244-15.10.244-1
linuxlinux_kernel>= 0 < 6.1.147-16.1.147-1
linuxlinux_kernel>= 0 < 6.12.35-16.12.35-1
linuxlinux_kernel>= 0 < 6.12.35-16.12.35-1
linuxlinux_kernel>= 0 < 5.15.0-156.1665.15.0-156.166
linuxlinux_kernel>= 0 < 6.8.0-100.1006.8.0-100.100
linuxlinux_kernel>= 4.8 < 5.4.2955.4.295
linuxlinux_kernel>= 5.11 < 5.15.1865.15.186
linuxlinux_kernel>= 5.16 < 6.1.1426.1.142
linuxlinux_kernel>= 5.5 < 5.10.2395.10.239
linuxlinux_kernel>= 6.13 < 6.15.46.15.4
linuxlinux_kernel>= 6.2 < 6.6.956.6.95

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.6MEDIUM