CVE-2025-38374XML External Entity (XXE) Injection in Linux

Severity
5.5MEDIUMNVD
GHSA7.5OSV5.6OSV3.2
EPSS
0.0%
top 95.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJul 25
Latest updateMar 25

Description

In the Linux kernel, the following vulnerability has been resolved: optee: ffa: fix sleep in atomic context The OP-TEE driver registers the function notif_callback() for FF-A notifications. However, this function is called in an atomic context leading to errors like this when processing asynchronous notifications: | BUG: sleeping function called from invalid context at kernel/locking/mutex.c:258 | in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0 | preempt_count: 1,

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages14 packages

NVDlinux/linux_kernel6.86.12.37+2
Debianlinux/linux_kernel< 6.12.37-1+1
Ubuntulinux/linux_kernel< 6.8.0-100.100
CVEListV5linux/linuxd0476a59de064205f4aaa8f7c6d6f32bc28a44d45f28563f0c6862c99eb115c918421d9b73f137ad+3
debiandebian/linux< linux 6.12.37-1 (forky)

Patches

🔴Vulnerability Details

25
OSV
linux-azure-6.8 vulnerabilities2026-03-25
OSV
linux-azure-fips vulnerabilities2026-03-04
OSV
linux-azure vulnerabilities2026-03-04
OSV
linux-ibm, linux-ibm-6.8 vulnerabilities2026-02-24
OSV
linux-xilinx vulnerabilities2026-02-24

📋Vendor Advisories

25
Ubuntu
Linux kernel (Azure) vulnerabilities2026-03-25
Ubuntu
Linux kernel (Azure) vulnerabilities2026-03-04
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities2026-03-04
Ubuntu
Linux kernel (Xilinx) vulnerabilities2026-02-24
Ubuntu
Linux kernel (IBM) vulnerabilities2026-02-24
CVE-2025-38374 — XML External Entity (XXE) Injection | cvebase