CVE-2025-38416 (GCVE-0-2025-38416)

Vulnerability from cvelistv5 – Published: 2025-07-25 14:00 – Updated: 2026-08-05 12:01
VLAI
Title
NFC: nci: uart: Set tty->disc_data only in success path
Summary
In the Linux kernel, the following vulnerability has been resolved: NFC: nci: uart: Set tty->disc_data only in success path Setting tty->disc_data before opening the NCI device means we need to clean it up on error paths. This also opens some short window if device starts sending data, even before NCIUARTSETDRIVER IOCTL succeeded (broken hardware?). Close the window by exposing tty->disc_data only on the success path, when opening of the NCI device and try_module_get() succeeds. The code differs in error path in one aspect: tty->disc_data won't be ever assigned thus NULL-ified. This however should not be relevant difference, because of "tty->disc_data=NULL" in nci_uart_tty_open().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 , < a514fca2b8e95838a3ba600f31a18fa60b76d893 (git)
Affected: 9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 , < 000bfbc6bc334a93fffca8f5aa9583e7b6356cb5 (git)
Affected: 9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 , < ac6992f72bd8e22679c1e147ac214de6a7093c23 (git)
Affected: 9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 , < dc7722619a9c307e9938d735cf4a2210d3d48dcb (git)
Affected: 9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 , < a8acc7080ad55c5402a1b818b3008998247dda87 (git)
Affected: 9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 , < 55c3dbd8389636161090a2b2b6d2d709b9602e9c (git)
Affected: 9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 , < e9799db771b2d574d5bf0dfb3177485e5f40d4d6 (git)
Affected: 9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 , < fc27ab48904ceb7e4792f0c400f1ef175edf16fe (git)
Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 5.4.295 , ≤ 5.4.* (semver)
Unaffected: 5.10.239 , ≤ 5.10.* (semver)
Unaffected: 5.15.186 , ≤ 5.15.* (semver)
Unaffected: 6.1.142 , ≤ 6.1.* (semver)
Unaffected: 6.6.95 , ≤ 6.6.* (semver)
Unaffected: 6.12.35 , ≤ 6.12.* (semver)
Unaffected: 6.15.4 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:47.815Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/nci/uart.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a514fca2b8e95838a3ba600f31a18fa60b76d893",
              "status": "affected",
              "version": "9961127d4bce6325e9a0b0fb105e0c85a6c62cb7",
              "versionType": "git"
            },
            {
              "lessThan": "000bfbc6bc334a93fffca8f5aa9583e7b6356cb5",
              "status": "affected",
              "version": "9961127d4bce6325e9a0b0fb105e0c85a6c62cb7",
              "versionType": "git"
            },
            {
              "lessThan": "ac6992f72bd8e22679c1e147ac214de6a7093c23",
              "status": "affected",
              "version": "9961127d4bce6325e9a0b0fb105e0c85a6c62cb7",
              "versionType": "git"
            },
            {
              "lessThan": "dc7722619a9c307e9938d735cf4a2210d3d48dcb",
              "status": "affected",
              "version": "9961127d4bce6325e9a0b0fb105e0c85a6c62cb7",
              "versionType": "git"
            },
            {
              "lessThan": "a8acc7080ad55c5402a1b818b3008998247dda87",
              "status": "affected",
              "version": "9961127d4bce6325e9a0b0fb105e0c85a6c62cb7",
              "versionType": "git"
            },
            {
              "lessThan": "55c3dbd8389636161090a2b2b6d2d709b9602e9c",
              "status": "affected",
              "version": "9961127d4bce6325e9a0b0fb105e0c85a6c62cb7",
              "versionType": "git"
            },
            {
              "lessThan": "e9799db771b2d574d5bf0dfb3177485e5f40d4d6",
              "status": "affected",
              "version": "9961127d4bce6325e9a0b0fb105e0c85a6c62cb7",
              "versionType": "git"
            },
            {
              "lessThan": "fc27ab48904ceb7e4792f0c400f1ef175edf16fe",
              "status": "affected",
              "version": "9961127d4bce6325e9a0b0fb105e0c85a6c62cb7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/nci/uart.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.295",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: nci: uart: Set tty-\u003edisc_data only in success path\n\nSetting tty-\u003edisc_data before opening the NCI device means we need to\nclean it up on error paths.  This also opens some short window if device\nstarts sending data, even before NCIUARTSETDRIVER IOCTL succeeded\n(broken hardware?).  Close the window by exposing tty-\u003edisc_data only on\nthe success path, when opening of the NCI device and try_module_get()\nsucceeds.\n\nThe code differs in error path in one aspect: tty-\u003edisc_data won\u0027t be\never assigned thus NULL-ified.  This however should not be relevant\ndifference, because of \"tty-\u003edisc_data=NULL\" in nci_uart_tty_open()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggering requires a local `NCIUARTSETDRIVER` ioctl on a tty fd whose line discipline was set to N_NCI, plus locally-injected tty receive data (e.g. via a pty master). No remote or adjacent-network actor can open the window on their own.\nAC:L - The attacker controls both sides of the race \u2014 one thread issues the ioctl on a pty slave while another writes to the pty master to drive `flush_to_ldisc` \u2192 `nci_uart_tty_receive()` \u2014 and the `nu-\u003eops.open()` failure that frees the object is inducible through attacker-driven memory pressure, so it can be retried until it lands.\nPR:L - `nci_uart_tty_ioctl()` performs no capability check and `/dev/ptmx` is world-accessible; on affected systems the nci_uart/nfcmrvl_uart modules are already resident, so the `capable(CAP_SYS_MODULE)` ldisc-autoload gate is not reached and a plain unprivileged user suffices.\nUI:N - The attacking process performs every step itself \u2014 opening the pty, setting the line discipline, issuing the ioctl and feeding the data. No victim action is involved.\nS:U - The use-after-free corrupts kernel heap state within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed `struct nci_uart` is reused while `nci_uart_default_recv_buf()` still dereferences `nu-\u003endev`, `nu-\u003erx_skb`, and `nu-\u003etty`, so a heap-sprayed replacement yields controlled kernel-memory reads and disclosure of adjacent slab contents.\nI:H - The stale object contains the `nu-\u003eops` function-pointer table (`ops.recv`, `ops.tx_start`) and a `work_struct`, giving an attacker who reclaims the slab a controlled indirect call and skb-pointer writes \u2014 sufficient for control-flow hijack and privilege escalation.\nA:H - Even without successful exploitation the use-after-free dereferences and the `schedule_work()` on freed memory reliably produce a kernel oops or panic, and the race can be retried indefinitely."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:43.897Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a514fca2b8e95838a3ba600f31a18fa60b76d893"
        },
        {
          "url": "https://git.kernel.org/stable/c/000bfbc6bc334a93fffca8f5aa9583e7b6356cb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac6992f72bd8e22679c1e147ac214de6a7093c23"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc7722619a9c307e9938d735cf4a2210d3d48dcb"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8acc7080ad55c5402a1b818b3008998247dda87"
        },
        {
          "url": "https://git.kernel.org/stable/c/55c3dbd8389636161090a2b2b6d2d709b9602e9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9799db771b2d574d5bf0dfb3177485e5f40d4d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc27ab48904ceb7e4792f0c400f1ef175edf16fe"
        }
      ],
      "title": "NFC: nci: uart: Set tty-\u003edisc_data only in success path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38416",
    "datePublished": "2025-07-25T14:00:17.849Z",
    "dateReserved": "2025-04-16T04:51:24.014Z",
    "dateUpdated": "2026-08-05T12:01:43.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38416",
      "date": "2026-08-05",
      "epss": "0.00183",
      "percentile": "0.08032"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T03:56:50.000Z",
      "cve": "CVE-2025-38416",
      "id": "msrc_CVE-2025-38416",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "NFC: nci: uart: Set tty-\u003edisc_data only in success path",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38416.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38416\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T14:15:33.373\",\"lastModified\":\"2026-07-30T06:23:13.120\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nNFC: nci: uart: Set tty-\u003edisc_data only in success path\\n\\nSetting tty-\u003edisc_data before opening the NCI device means we need to\\nclean it up on error paths.  This also opens some short window if device\\nstarts sending data, even before NCIUARTSETDRIVER IOCTL succeeded\\n(broken hardware?).  Close the window by exposing tty-\u003edisc_data only on\\nthe success path, when opening of the NCI device and try_module_get()\\nsucceeds.\\n\\nThe code differs in error path in one aspect: tty-\u003edisc_data won\u0027t be\\never assigned thus NULL-ified.  This however should not be relevant\\ndifference, because of \\\"tty-\u003edisc_data=NULL\\\" in nci_uart_tty_open().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: NFC: nci: uart: Establecer tty-\u0026gt;disc_data solo en la ruta correcta. Configurar tty-\u0026gt;disc_data antes de abrir el dispositivo NCI implica la necesidad de eliminar las rutas de error. Esto tambi\u00e9n genera una peque\u00f1a ventana de tiempo si el dispositivo comienza a enviar datos, incluso antes de que NCIUARTSETDRIVER IOCTL se haya ejecutado correctamente (\u00bfhardware da\u00f1ado?). Esta ventana se cierra exponiendo tty-\u0026gt;disc_data solo en la ruta correcta cuando se abre el dispositivo NCI y try_module_get() se ejecuta correctamente. El c\u00f3digo difiere en la ruta de error en un aspecto: tty-\u0026gt;disc_data nunca se asignar\u00e1, por lo que se convierte en NULL. Sin embargo, esta diferencia no deber\u00eda ser relevante, debido a \\\"tty-\u0026gt;disc_data=NULL\\\" en nci_uart_tty_open().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/nfc/nci/uart.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9961127d4bce6325e9a0b0fb105e0c85a6c62cb7\",\"lessThan\":\"a514fca2b8e95838a3ba600f31a18fa60b76d893\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9961127d4bce6325e9a0b0fb105e0c85a6c62cb7\",\"lessThan\":\"000bfbc6bc334a93fffca8f5aa9583e7b6356cb5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9961127d4bce6325e9a0b0fb105e0c85a6c62cb7\",\"lessThan\":\"ac6992f72bd8e22679c1e147ac214de6a7093c23\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9961127d4bce6325e9a0b0fb105e0c85a6c62cb7\",\"lessThan\":\"dc7722619a9c307e9938d735cf4a2210d3d48dcb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9961127d4bce6325e9a0b0fb105e0c85a6c62cb7\",\"lessThan\":\"a8acc7080ad55c5402a1b818b3008998247dda87\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9961127d4bce6325e9a0b0fb105e0c85a6c62cb7\",\"lessThan\":\"55c3dbd8389636161090a2b2b6d2d709b9602e9c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9961127d4bce6325e9a0b0fb105e0c85a6c62cb7\",\"lessThan\":\"e9799db771b2d574d5bf0dfb3177485e5f40d4d6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9961127d4bce6325e9a0b0fb105e0c85a6c62cb7\",\"lessThan\":\"fc27ab48904ceb7e4792f0c400f1ef175edf16fe\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/nfc/nci/uart.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.295\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.239\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.186\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.142\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.95\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.35\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.4\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.2\",\"versionEndExcluding\":\"5.4.295\",\"matchCriteriaId\":\"963AC76E-7248-4EA1-BE0D-A7B2CD5F14F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.239\",\"matchCriteriaId\":\"C3D14F4C-A21E-465D-A928-5CCE684E2B98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.186\",\"matchCriteriaId\":\"D96F2C0D-0D4A-4658-AD34-D8A626EA422D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.142\",\"matchCriteriaId\":\"459B4E94-FE0E-434D-B782-95E3A5FFC6B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.95\",\"matchCriteriaId\":\"C5E01853-7048-4D78-9479-9AEE41AC8456\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.35\",\"matchCriteriaId\":\"E569FD34-0076-4428-BE17-EECCF867611C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.4\",\"matchCriteriaId\":\"DFD174C5-1AA2-4671-BDDC-1A9FCC753655\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/000bfbc6bc334a93fffca8f5aa9583e7b6356cb5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/55c3dbd8389636161090a2b2b6d2d709b9602e9c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a514fca2b8e95838a3ba600f31a18fa60b76d893\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a8acc7080ad55c5402a1b818b3008998247dda87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ac6992f72bd8e22679c1e147ac214de6a7093c23\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dc7722619a9c307e9938d735cf4a2210d3d48dcb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e9799db771b2d574d5bf0dfb3177485e5f40d4d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fc27ab48904ceb7e4792f0c400f1ef175edf16fe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:29:48+00:00",
      "cve": "CVE-2025-38416",
      "id": "CVE-2025-38416",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: NFC: nci: uart: Set tty-\u003edisc_data only in success path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38416.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T00:46:33Z",
      "cve": "CVE-2025-38416",
      "id": "CVE-2025-38416",
      "initial_release_date": "2025-07-29T23:23:53Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "633",
      "product_status:known_not_affected": "52",
      "product_status:recommended": "508",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38416",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38416.json",
      "version": "71"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.