CVE-2025-38401 (GCVE-0-2025-38401)

Vulnerability from cvelistv5 – Published: 2025-07-25 12:53 – Updated: 2026-08-05 12:01
VLAI
Title
mtk-sd: Prevent memory corruption from DMA map failure
Summary
In the Linux kernel, the following vulnerability has been resolved: mtk-sd: Prevent memory corruption from DMA map failure If msdc_prepare_data() fails to map the DMA region, the request is not prepared for data receiving, but msdc_start_data() proceeds the DMA with previous setting. Since this will lead a memory corruption, we have to stop the request operation soon after the msdc_prepare_data() fails to prepare it.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 208489032bdd8d4a7de50f3057c175058f271956 , < 5ac9e9e2e9cd6247d8c2d99780eae4556049e1cc (git)
Affected: 208489032bdd8d4a7de50f3057c175058f271956 , < d54771571f74a82c59830a32e76af78a8e57ac69 (git)
Affected: 208489032bdd8d4a7de50f3057c175058f271956 , < 48bf4f3dfcdab02b22581d8e350a2d23130b72c0 (git)
Affected: 208489032bdd8d4a7de50f3057c175058f271956 , < 63e8953f16acdcb23e2d4dd8a566d3c34df3e200 (git)
Affected: 208489032bdd8d4a7de50f3057c175058f271956 , < 61cdd663564674ea21ceb50aa9d3697cbe9e45f9 (git)
Affected: 208489032bdd8d4a7de50f3057c175058f271956 , < 3419bc6a7b65cbbb91417bb9970208478e034c79 (git)
Affected: 208489032bdd8d4a7de50f3057c175058f271956 , < a5f5f67b284d81776d4a3eb1f8607e4b7f91f11c (git)
Affected: 208489032bdd8d4a7de50f3057c175058f271956 , < f5de469990f19569627ea0dd56536ff5a13beaa3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 5.4.296 , ≤ 5.4.* (semver)
Unaffected: 5.10.240 , ≤ 5.10.* (semver)
Unaffected: 5.15.187 , ≤ 5.15.* (semver)
Unaffected: 6.1.144 , ≤ 6.1.* (semver)
Unaffected: 6.6.97 , ≤ 6.6.* (semver)
Unaffected: 6.12.37 , ≤ 6.12.* (semver)
Unaffected: 6.15.6 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:35.519Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mmc/host/mtk-sd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5ac9e9e2e9cd6247d8c2d99780eae4556049e1cc",
              "status": "affected",
              "version": "208489032bdd8d4a7de50f3057c175058f271956",
              "versionType": "git"
            },
            {
              "lessThan": "d54771571f74a82c59830a32e76af78a8e57ac69",
              "status": "affected",
              "version": "208489032bdd8d4a7de50f3057c175058f271956",
              "versionType": "git"
            },
            {
              "lessThan": "48bf4f3dfcdab02b22581d8e350a2d23130b72c0",
              "status": "affected",
              "version": "208489032bdd8d4a7de50f3057c175058f271956",
              "versionType": "git"
            },
            {
              "lessThan": "63e8953f16acdcb23e2d4dd8a566d3c34df3e200",
              "status": "affected",
              "version": "208489032bdd8d4a7de50f3057c175058f271956",
              "versionType": "git"
            },
            {
              "lessThan": "61cdd663564674ea21ceb50aa9d3697cbe9e45f9",
              "status": "affected",
              "version": "208489032bdd8d4a7de50f3057c175058f271956",
              "versionType": "git"
            },
            {
              "lessThan": "3419bc6a7b65cbbb91417bb9970208478e034c79",
              "status": "affected",
              "version": "208489032bdd8d4a7de50f3057c175058f271956",
              "versionType": "git"
            },
            {
              "lessThan": "a5f5f67b284d81776d4a3eb1f8607e4b7f91f11c",
              "status": "affected",
              "version": "208489032bdd8d4a7de50f3057c175058f271956",
              "versionType": "git"
            },
            {
              "lessThan": "f5de469990f19569627ea0dd56536ff5a13beaa3",
              "status": "affected",
              "version": "208489032bdd8d4a7de50f3057c175058f271956",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mmc/host/mtk-sd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.187",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.144",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtk-sd: Prevent memory corruption from DMA map failure\n\nIf msdc_prepare_data() fails to map the DMA region, the request is\nnot prepared for data receiving, but msdc_start_data() proceeds\nthe DMA with previous setting.\nSince this will lead a memory corruption, we have to stop the\nrequest operation soon after the msdc_prepare_data() fails to\nprepare it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is the MMC/SD block request path reached through ordinary local file or block-device I/O on the eMMC/SD device; no network or remote peer is involved.\nAC:L - The only precondition is a dma_map_sg() failure, which a local attacker directly induces by exhausting swiotlb bounce buffers, a restricted-dma-pool, or M4U IOVA space with concurrent large O_DIRECT I/O and memory pressure, then reliably lands the corrupt transfer since every subsequent request re-arms the stale BD ring.\nPR:L - Any unprivileged local user can submit MMC requests simply by reading/writing files on the eMMC- or SD-backed filesystem and can generate the DMA-resource pressure needed; no capability or root check exists anywhere on the path.\nUI:N - The corrupt DMA is started by the driver itself as soon as a mapping failure occurs during normal I/O; no victim action is required.\nS:U - The corruption is device DMA into kernel memory managed by the same kernel security authority; no VM, sandbox, or IOMMU translation boundary is crossed.\nC:H - On write transfers the controller streams the contents of stale, already-unmapped and potentially reallocated kernel pages out to the SD/eMMC medium, and the resulting corruption is leverageable for broader kernel memory disclosure.\nI:H - On read transfers the hardware writes attacker-supplied card data into freed/reused kernel memory at stale physical addresses, an uncontrolled kernel write primitive suitable for control-flow hijacking \u2014 the commit itself states this \"will lead a memory corruption\".\nA:H - The mismatched descriptor state triggers DMA protect/checksum errors and data timeouts, and DMA into reallocated kernel memory readily produces oopses and panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:37.420Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5ac9e9e2e9cd6247d8c2d99780eae4556049e1cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/d54771571f74a82c59830a32e76af78a8e57ac69"
        },
        {
          "url": "https://git.kernel.org/stable/c/48bf4f3dfcdab02b22581d8e350a2d23130b72c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/63e8953f16acdcb23e2d4dd8a566d3c34df3e200"
        },
        {
          "url": "https://git.kernel.org/stable/c/61cdd663564674ea21ceb50aa9d3697cbe9e45f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3419bc6a7b65cbbb91417bb9970208478e034c79"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5f5f67b284d81776d4a3eb1f8607e4b7f91f11c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5de469990f19569627ea0dd56536ff5a13beaa3"
        }
      ],
      "title": "mtk-sd: Prevent memory corruption from DMA map failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38401",
    "datePublished": "2025-07-25T12:53:44.961Z",
    "dateReserved": "2025-04-16T04:51:24.012Z",
    "dateUpdated": "2026-08-05T12:01:37.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38401",
      "date": "2026-09-26",
      "epss": "0.00181",
      "percentile": "0.06888"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-24T14:41:08.000Z",
      "cve": "CVE-2025-38401",
      "id": "msrc_CVE-2025-38401",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mtk-sd: Prevent memory corruption from DMA map failure",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38401.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/mmc/host/mtk-sd.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5ac9e9e2e9cd6247d8c2d99780eae4556049e1cc",
                    "status": "affected",
                    "version": "208489032bdd8d4a7de50f3057c175058f271956",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d54771571f74a82c59830a32e76af78a8e57ac69",
                    "status": "affected",
                    "version": "208489032bdd8d4a7de50f3057c175058f271956",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "48bf4f3dfcdab02b22581d8e350a2d23130b72c0",
                    "status": "affected",
                    "version": "208489032bdd8d4a7de50f3057c175058f271956",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "63e8953f16acdcb23e2d4dd8a566d3c34df3e200",
                    "status": "affected",
                    "version": "208489032bdd8d4a7de50f3057c175058f271956",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "61cdd663564674ea21ceb50aa9d3697cbe9e45f9",
                    "status": "affected",
                    "version": "208489032bdd8d4a7de50f3057c175058f271956",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3419bc6a7b65cbbb91417bb9970208478e034c79",
                    "status": "affected",
                    "version": "208489032bdd8d4a7de50f3057c175058f271956",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a5f5f67b284d81776d4a3eb1f8607e4b7f91f11c",
                    "status": "affected",
                    "version": "208489032bdd8d4a7de50f3057c175058f271956",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f5de469990f19569627ea0dd56536ff5a13beaa3",
                    "status": "affected",
                    "version": "208489032bdd8d4a7de50f3057c175058f271956",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/mmc/host/mtk-sd.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.2"
                  },
                  {
                    "lessThan": "4.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.296",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.240",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.187",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.144",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.37",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.15.*",
                    "status": "unaffected",
                    "version": "6.15.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.16",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A3C25D85-948E-43F9-A66F-C49608D4D431",
                    "versionEndExcluding": "5.4.296",
                    "versionStartIncluding": "4.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0E73A49A-F9B2-470F-91B2-6FAB6239BDB6",
                    "versionEndExcluding": "5.10.240",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4BD28D29-423C-4173-9DB8-3BA14E9F665D",
                    "versionEndExcluding": "5.15.187",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "81CF08DB-B7A2-4556-8AE3-ED9144F50E31",
                    "versionEndExcluding": "6.1.144",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EB1BB991-B903-4718-966C-07C803CBEABC",
                    "versionEndExcluding": "6.6.97",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6B4159AA-C70D-4DE5-9EE2-8F2728F13C5D",
                    "versionEndExcluding": "6.12.37",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6E0BB4E0-44BC-4645-83A8-6EA232CE624C",
                    "versionEndExcluding": "6.15.6",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtk-sd: Prevent memory corruption from DMA map failure\n\nIf msdc_prepare_data() fails to map the DMA region, the request is\nnot prepared for data receiving, but msdc_start_data() proceeds\nthe DMA with previous setting.\nSince this will lead a memory corruption, we have to stop the\nrequest operation soon after the msdc_prepare_data() fails to\nprepare it."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mtk-sd: Prevenir la corrupci\u00f3n de memoria por un fallo en el mapeo de DMA. Si msdc_prepare_data() no logra mapear la regi\u00f3n DMA, la solicitud no se prepara para la recepci\u00f3n de datos, pero msdc_start_data() contin\u00faa el DMA con la configuraci\u00f3n anterior. Dado que esto provocar\u00e1 una corrupci\u00f3n de memoria, debemos detener la solicitud poco despu\u00e9s de que msdc_prepare_data() no la prepare."
          }
        ],
        "id": "CVE-2025-38401",
        "lastModified": "2026-07-30T06:23:12.390",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-07-25T13:15:29.660",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3419bc6a7b65cbbb91417bb9970208478e034c79"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/48bf4f3dfcdab02b22581d8e350a2d23130b72c0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5ac9e9e2e9cd6247d8c2d99780eae4556049e1cc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/61cdd663564674ea21ceb50aa9d3697cbe9e45f9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/63e8953f16acdcb23e2d4dd8a566d3c34df3e200"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a5f5f67b284d81776d4a3eb1f8607e4b7f91f11c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d54771571f74a82c59830a32e76af78a8e57ac69"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f5de469990f19569627ea0dd56536ff5a13beaa3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:32:57+00:00",
      "cve": "CVE-2025-38401",
      "id": "CVE-2025-38401",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mtk-sd: Prevent memory corruption from DMA map failure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38401.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-24T16:38:55Z",
      "cve": "CVE-2025-38401",
      "id": "CVE-2025-38401",
      "initial_release_date": "2025-07-28T23:23:40Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "404",
      "product_status:known_not_affected": "444",
      "product_status:recommended": "472",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38401",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38401.json",
      "version": "44"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.