CVE-2025-38335 (GCVE-0-2025-38335)
Vulnerability from cvelistv5 – Published: 2025-07-10 08:15 – Updated: 2026-05-11 21:25
VLAI
EPSS
VEX
Title
Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
When enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in
hard irq context, but the input_event() takes a spin_lock, which isn't
allowed there as it is converted to a rt_spin_lock().
[ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
[ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0
...
[ 4054.290195] __might_resched+0x13c/0x1f4
[ 4054.290209] rt_spin_lock+0x54/0x11c
[ 4054.290219] input_event+0x48/0x80
[ 4054.290230] gpio_keys_irq_timer+0x4c/0x78
[ 4054.290243] __hrtimer_run_queues+0x1a4/0x438
[ 4054.290257] hrtimer_interrupt+0xe4/0x240
[ 4054.290269] arch_timer_handler_phys+0x2c/0x44
[ 4054.290283] handle_percpu_devid_irq+0x8c/0x14c
[ 4054.290297] handle_irq_desc+0x40/0x58
[ 4054.290307] generic_handle_domain_irq+0x1c/0x28
[ 4054.290316] gic_handle_irq+0x44/0xcc
Considering the gpio_keys_irq_isr() can run in any context, e.g. it can
be threaded, it seems there's no point in requesting the timer isr to
run in hard irq context.
Relax the hrtimer not to use the hard context.
Severity
5.5 (Medium)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
019002f20cb5b9f78d39360aff244265d035e08a , < 664e5a6f541ff226621487d1280d2ec28e86be28
(git)
Affected: 019002f20cb5b9f78d39360aff244265d035e08a , < a8f01e51109f77229e426b57c5d19251b462c6aa (git) Affected: 019002f20cb5b9f78d39360aff244265d035e08a , < fa53beab4740c4e5fe969f218a379f9558be33dc (git) Affected: 019002f20cb5b9f78d39360aff244265d035e08a , < a7b79db25846459de63ca8974268f0c41c734c4b (git) Affected: 019002f20cb5b9f78d39360aff244265d035e08a , < ec8f5da79b425deef5aebacdd4fe645620cd4f0b (git) Affected: 019002f20cb5b9f78d39360aff244265d035e08a , < f4a8f561d08e39f7833d4a278ebfb12a41eef15f (git) |
guessed | |
| Linux | Linux |
Affected:
5.13
Unaffected: 0 , < 5.13 (semver) Unaffected: 5.15.190 , ≤ 5.15.* (semver) Unaffected: 6.1.148 , ≤ 6.1.* (semver) Unaffected: 6.6.101 , ≤ 6.6.* (semver) Unaffected: 6.12.41 , ≤ 6.12.* (semver) Unaffected: 6.15.4 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-03T17:36:43.814Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/keyboard/gpio_keys.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "664e5a6f541ff226621487d1280d2ec28e86be28",
"status": "affected",
"version": "019002f20cb5b9f78d39360aff244265d035e08a",
"versionType": "git"
},
{
"lessThan": "a8f01e51109f77229e426b57c5d19251b462c6aa",
"status": "affected",
"version": "019002f20cb5b9f78d39360aff244265d035e08a",
"versionType": "git"
},
{
"lessThan": "fa53beab4740c4e5fe969f218a379f9558be33dc",
"status": "affected",
"version": "019002f20cb5b9f78d39360aff244265d035e08a",
"versionType": "git"
},
{
"lessThan": "a7b79db25846459de63ca8974268f0c41c734c4b",
"status": "affected",
"version": "019002f20cb5b9f78d39360aff244265d035e08a",
"versionType": "git"
},
{
"lessThan": "ec8f5da79b425deef5aebacdd4fe645620cd4f0b",
"status": "affected",
"version": "019002f20cb5b9f78d39360aff244265d035e08a",
"versionType": "git"
},
{
"lessThan": "f4a8f561d08e39f7833d4a278ebfb12a41eef15f",
"status": "affected",
"version": "019002f20cb5b9f78d39360aff244265d035e08a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/keyboard/gpio_keys.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.190",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.41",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.190",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.148",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.101",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.41",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.4",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: gpio-keys - fix a sleep while atomic with PREEMPT_RT\n\nWhen enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in\nhard irq context, but the input_event() takes a spin_lock, which isn\u0027t\nallowed there as it is converted to a rt_spin_lock().\n\n[ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\n[ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0\n...\n[ 4054.290195] __might_resched+0x13c/0x1f4\n[ 4054.290209] rt_spin_lock+0x54/0x11c\n[ 4054.290219] input_event+0x48/0x80\n[ 4054.290230] gpio_keys_irq_timer+0x4c/0x78\n[ 4054.290243] __hrtimer_run_queues+0x1a4/0x438\n[ 4054.290257] hrtimer_interrupt+0xe4/0x240\n[ 4054.290269] arch_timer_handler_phys+0x2c/0x44\n[ 4054.290283] handle_percpu_devid_irq+0x8c/0x14c\n[ 4054.290297] handle_irq_desc+0x40/0x58\n[ 4054.290307] generic_handle_domain_irq+0x1c/0x28\n[ 4054.290316] gic_handle_irq+0x44/0xcc\n\nConsidering the gpio_keys_irq_isr() can run in any context, e.g. it can\nbe threaded, it seems there\u0027s no point in requesting the timer isr to\nrun in hard irq context.\n\nRelax the hrtimer not to use the hard context."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T21:25:59.822Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/664e5a6f541ff226621487d1280d2ec28e86be28"
},
{
"url": "https://git.kernel.org/stable/c/a8f01e51109f77229e426b57c5d19251b462c6aa"
},
{
"url": "https://git.kernel.org/stable/c/fa53beab4740c4e5fe969f218a379f9558be33dc"
},
{
"url": "https://git.kernel.org/stable/c/a7b79db25846459de63ca8974268f0c41c734c4b"
},
{
"url": "https://git.kernel.org/stable/c/ec8f5da79b425deef5aebacdd4fe645620cd4f0b"
},
{
"url": "https://git.kernel.org/stable/c/f4a8f561d08e39f7833d4a278ebfb12a41eef15f"
}
],
"title": "Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38335",
"datePublished": "2025-07-10T08:15:07.063Z",
"dateReserved": "2025-04-16T04:51:24.005Z",
"dateUpdated": "2026-05-11T21:25:59.822Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-38335",
"date": "2026-09-16",
"epss": "0.00121",
"percentile": "0.02222"
},
"microsoft_vex": {
"current_release_date": "2026-02-24T14:36:37.000Z",
"cve": "CVE-2025-38335",
"id": "msrc_CVE-2025-38335",
"initial_release_date": "2025-07-02T00:00:00.000Z",
"product_status:fixed": "2",
"product_status:known_affected": "3",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT",
"url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38335.json",
"version": "3"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2025-38335\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-10T09:15:28.100\",\"lastModified\":\"2026-06-17T09:16:38.870\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nInput: gpio-keys - fix a sleep while atomic with PREEMPT_RT\\n\\nWhen enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in\\nhard irq context, but the input_event() takes a spin_lock, which isn\u0027t\\nallowed there as it is converted to a rt_spin_lock().\\n\\n[ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\\n[ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0\\n...\\n[ 4054.290195] __might_resched+0x13c/0x1f4\\n[ 4054.290209] rt_spin_lock+0x54/0x11c\\n[ 4054.290219] input_event+0x48/0x80\\n[ 4054.290230] gpio_keys_irq_timer+0x4c/0x78\\n[ 4054.290243] __hrtimer_run_queues+0x1a4/0x438\\n[ 4054.290257] hrtimer_interrupt+0xe4/0x240\\n[ 4054.290269] arch_timer_handler_phys+0x2c/0x44\\n[ 4054.290283] handle_percpu_devid_irq+0x8c/0x14c\\n[ 4054.290297] handle_irq_desc+0x40/0x58\\n[ 4054.290307] generic_handle_domain_irq+0x1c/0x28\\n[ 4054.290316] gic_handle_irq+0x44/0xcc\\n\\nConsidering the gpio_keys_irq_isr() can run in any context, e.g. it can\\nbe threaded, it seems there\u0027s no point in requesting the timer isr to\\nrun in hard irq context.\\n\\nRelax the hrtimer not to use the hard context.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Entrada: gpio-keys - corrige un fallo de suspensi\u00f3n mientras es at\u00f3mico con PREEMPT_RT Al habilitar PREEMPT_RT, la devoluci\u00f3n de llamada gpio_keys_irq_timer() se ejecuta en un contexto de irq duro, pero input_event() toma un spin_lock, que no est\u00e1 permitido all\u00ed ya que se convierte en un rt_spin_lock(). [ 4054.289999] ERROR: funci\u00f3n de suspensi\u00f3n llamada desde un contexto no v\u00e1lido en kernel/locking/spinlock_rt.c:48 [ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0 ... [ 4054.290195] __might_resched+0x13c/0x1f4 [ 4054.290209] rt_spin_lock+0x54/0x11c [ 4054.290219] input_event+0x48/0x80 [ 4054.290230] gpio_keys_irq_timer+0x4c/0x78 [ 4054.290243] __hrtimer_run_queues+0x1a4/0x438 [ 4054.290257] hrtimer_interrupt+0xe4/0x240 [ 4054.290269] arch_timer_handler_phys+0x2c/0x44 [ 4054.290283] handle_percpu_devid_irq+0x8c/0x14c [ 4054.290297] handle_irq_desc+0x40/0x58 [ 4054.290307] generic_handle_domain_irq+0x1c/0x28 [ 4054.290316] gic_handle_irq+0x44/0xcc Teniendo en cuenta que gpio_keys_irq_isr() puede ejecutarse en cualquier contexto, por ejemplo, puede ser Enhebrado, parece que no tiene sentido solicitar que el temporizador ISR se ejecute en un contexto de IRQ estricto. Reduzca la velocidad del temporizador hr para que no use dicho contexto.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/input/keyboard/gpio_keys.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"019002f20cb5b9f78d39360aff244265d035e08a\",\"lessThan\":\"664e5a6f541ff226621487d1280d2ec28e86be28\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"019002f20cb5b9f78d39360aff244265d035e08a\",\"lessThan\":\"a8f01e51109f77229e426b57c5d19251b462c6aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"019002f20cb5b9f78d39360aff244265d035e08a\",\"lessThan\":\"fa53beab4740c4e5fe969f218a379f9558be33dc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"019002f20cb5b9f78d39360aff244265d035e08a\",\"lessThan\":\"a7b79db25846459de63ca8974268f0c41c734c4b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"019002f20cb5b9f78d39360aff244265d035e08a\",\"lessThan\":\"ec8f5da79b425deef5aebacdd4fe645620cd4f0b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"019002f20cb5b9f78d39360aff244265d035e08a\",\"lessThan\":\"f4a8f561d08e39f7833d4a278ebfb12a41eef15f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/input/keyboard/gpio_keys.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.190\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.148\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.101\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.41\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.4\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13\",\"versionEndExcluding\":\"5.15.190\",\"matchCriteriaId\":\"00A77226-2C17-41C7-BAA0-A33ECE2B2912\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.148\",\"matchCriteriaId\":\"3E5B1B93-C244-4B54-B3AB-12C2635A443B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.101\",\"matchCriteriaId\":\"686C7A1C-35F3-495D-9825-94B5BCED2705\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.41\",\"matchCriteriaId\":\"7B9B92B6-A7E5-4697-AB94-8432ED55AA05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.4\",\"matchCriteriaId\":\"DFD174C5-1AA2-4671-BDDC-1A9FCC753655\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/664e5a6f541ff226621487d1280d2ec28e86be28\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7b79db25846459de63ca8974268f0c41c734c4b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a8f01e51109f77229e426b57c5d19251b462c6aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec8f5da79b425deef5aebacdd4fe645620cd4f0b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f4a8f561d08e39f7833d4a278ebfb12a41eef15f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fa53beab4740c4e5fe969f218a379f9558be33dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-06-30T01:04:19+00:00",
"cve": "CVE-2025-38335",
"id": "CVE-2025-38335",
"initial_release_date": "2025-07-10T00:00:00+00:00",
"product_status:known_affected": "184",
"product_status:known_not_affected": "90",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38335.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-05T00:38:50Z",
"cve": "CVE-2025-38335",
"id": "CVE-2025-38335",
"initial_release_date": "2025-07-10T23:22:19Z",
"product_status:first_fixed": "2",
"product_status:known_affected": "400",
"product_status:known_not_affected": "436",
"product_status:recommended": "472",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2025-38335",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38335.json",
"version": "44"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…