目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1336 CNY

100%
コーヒーを一杯おごる

CVE-2025-38398— Linux kernel 安全漏洞

CVSS 7.8 · High EPSS 0.14% · P3

Affected Version Matrix 6

ベンダープロダクトVersion Rangeステータス
LinuxLinux7304d1909080ef0c9da703500a97f46c98393fcd< 86fb36de1132b560f9305f0c78fa69f459fa0980affected
7304d1909080ef0c9da703500a97f46c98393fcd< d85d0380292a7e618915069c3579ae23c7c80339affected
6.15affected
< 6.15unaffected
6.15.6≤ 6.15.*unaffected
6.16≤ *unaffected
新しい脆弱性情報の通知を購読するログインして購読

I. CVE-2025-38398の基本情報

脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗

高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。

脆弱性タイトル
spi: spi-qpic-snand: reallocate BAM transactions
ソース: CVE Program / CVE List V5
脆弱性説明
In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: reallocate BAM transactions Using the mtd_nandbiterrs module for testing the driver occasionally results in weird things like below. 1. swiotlb mapping fails with the following message: [ 85.926216] qcom_snand 79b0000.spi: swiotlb buffer is full (sz: 4294967294 bytes), total 512 (slots), used 0 (slots) [ 85.932937] qcom_snand 79b0000.spi: failure in mapping desc [ 87.999314] qcom_snand 79b0000.spi: failure to write raw page [ 87.999352] mtd_nandbiterrs: error: write_oob failed (-110) Rebooting the board after this causes a panic due to a NULL pointer dereference. 2. If the swiotlb mapping does not fail, rebooting the board may result in a different panic due to a bad spinlock magic: [ 256.104459] BUG: spinlock bad magic on CPU#3, procd/2241 [ 256.104488] Unable to handle kernel paging request at virtual address ffffffff0000049b ... Investigating the issue revealed that these symptoms are results of memory corruption which is caused by out of bounds access within the driver. The driver uses a dynamically allocated structure for BAM transactions, which structure must have enough space for all possible variations of different flash operations initiated by the driver. The required space heavily depends on the actual number of 'codewords' which is calculated from the pagesize of the actual NAND chip. Although the qcom_nandc_alloc() function allocates memory for the BAM transactions during probe, but since the actual number of 'codewords' is not yet know the allocation is done for one 'codeword' only. Because of this, whenever the driver does a flash operation, and the number of the required transactions exceeds the size of the allocated arrays the driver accesses memory out of the allocated range. To avoid this, change the code to free the initially allocated BAM transactions memory, and allocate a new one once the actual number of 'codewords' required for a given NAND chip is known.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ソース: CVE Program / CVE List V5
脆弱性タイプ
N/A
ソース: CVE Program / CVE List V5
脆弱性タイトル
Linux kernel 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于BAM事务重新分配可能导致映射失败。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)

影響を受ける製品

ベンダープロダクト影響を受けるバージョンCPE購読
LinuxLinux 7304d1909080ef0c9da703500a97f46c98393fcd ~ 86fb36de1132b560f9305f0c78fa69f459fa0980 -
LinuxLinux 6.15 -

II. CVE-2025-38398の公開POC

#POC説明ソースリンクShenlongリンク
AI生成POCプレミアム

公開POCは見つかりませんでした。

ログインしてAI POCを生成

III. CVE-2025-38398のインテリジェンス情報

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-07-25 · 114 CVEs total

CVE-2025-3842910.0 CRITICALbus: mhi: ep: Update read pointer only after buffer is written
CVE-2025-384119.8 CRITICALnetfs: Fix double put of request
CVE-2025-384309.8 CRITICALnfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
CVE-2025-384399.8 CRITICALbnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
CVE-2025-383659.1 CRITICALbtrfs: fix a race between renames and directory logging
CVE-2025-384378.8 HIGHksmbd: fix potential use-after-free in oplock/lease break ack
CVE-2025-383778.8 HIGHrose: fix dangling neighbour pointers in rose_rt_device_down()
CVE-2025-383678.8 HIGHLoongArch: KVM: Avoid overflow with array index
CVE-2025-383958.4 HIGHregulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
CVE-2025-383758.4 HIGHvirtio-net: ensure the received length does not exceed allocated size
CVE-2025-384347.8 HIGHRevert "riscv: Define TASK_SIZE_MAX for __access_ok()"
CVE-2025-383967.8 HIGHfs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
CVE-2025-384497.8 HIGHdrm/gem: Acquire references on GEM handles for framebuffers
CVE-2025-383827.8 HIGHbtrfs: fix iteration of extrefs during log replay
CVE-2025-384127.8 HIGHplatform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks
CVE-2025-384227.8 HIGHnet: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
CVE-2025-384407.8 HIGHnet/mlx5e: Fix race between DIM disable and net_dim()
CVE-2025-384087.8 HIGHgenirq/irq_sim: Initialize work context pointers properly
CVE-2025-384017.8 HIGHmtk-sd: Prevent memory corruption from DMA map failure
CVE-2025-384477.8 HIGHmm/rmap: fix potential out-of-bounds page table access during batched unmap

Showing 20 of 114 CVEs. View all on vendor page →

IV. 関連脆弱性

同じ製品: Linux
同じベンダー: Linux

V. CVE-2025-38398へのコメント

まだコメントはありません

コメントを残す