CVE-2025-38426 — Out-of-bounds Read in Linux

CWE-125 — Out-of-bounds Read19 documents7 sources
Severity
5.5MEDIUMNVD
OSV5.6
EPSS
0.0%
top 90.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
17
LinuxLinux KernelDebian Linux+14 more
Timeline
PublishedJul 25
Latest updateNov 4

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Add basic validation for RAS header If RAS header read from EEPROM is corrupted, it could result in trying to allocate huge memory for reading the records. Add some validation to header fields.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages18 packages

▶NVDlinux/linux_kernel5.4 — 6.15.4
▶Debianlinux/linux_kernel< 6.16.3-1

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

8
OSV
linux-hwe-6.14 vulnerabilities↗2025-11-04
▶
OSV
linux-gcp-6.14 vulnerabilities↗2025-10-31
▶
OSV
linux-aws-6.14 vulnerabilities↗2025-10-24
▶
OSV
linux-realtime-6.14 vulnerabilities↗2025-10-22
▶
OSV
linux-azure, linux-azure-6.14, linux-azure-nvidia-6.14 vulnerabilities↗2025-10-22
▶

📋Vendor Advisories

10
Ubuntu
Linux kernel (HWE) vulnerabilities↗2025-11-04
▶
Ubuntu
Linux kernel (GCP) vulnerabilities↗2025-10-31
▶
Ubuntu
Linux kernel (AWS) vulnerabilities↗2025-10-24
▶
Ubuntu
Linux kernel (Azure) vulnerabilities↗2025-10-22
▶
Ubuntu
Linux kernel (Real-time) vulnerabilities↗2025-10-22
▶