CVE-2025-38374 — XML External Entity (XXE) Injection in Linux
Severity
5.5MEDIUMNVD
GHSA7.5OSV5.6OSV3.2
EPSS
0.0%
top 95.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 25
Latest updateMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
optee: ffa: fix sleep in atomic context
The OP-TEE driver registers the function notif_callback() for FF-A
notifications. However, this function is called in an atomic context
leading to errors like this when processing asynchronous notifications:
| BUG: sleeping function called from invalid context at kernel/locking/mutex.c:258
| in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0
| preempt_count: 1, …
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages14 packages
▶CVEListV5linux/linuxd0476a59de064205f4aaa8f7c6d6f32bc28a44d4 — 5f28563f0c6862c99eb115c918421d9b73f137ad+3