CVE-2025-38422 (GCVE-0-2025-38422)

Vulnerability from cvelistv5 – Published: 2025-07-25 14:16 – Updated: 2026-08-05 12:01
VLAI
Title
net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
Summary
In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices Maximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb and 64 Kb respectively. Adjust max size definitions and return correct EEPROM length based on device. Also prevent out-of-bound read/write.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 695846047aa9b4bb387473a9fd227a51ae7de5e9 , < 6b4201d74d0a49af2123abf2c9d142e59566714b (git)
Affected: 695846047aa9b4bb387473a9fd227a51ae7de5e9 , < 088279ff18cdc437d6fac5890e0c52c624f78a5b (git)
Affected: 695846047aa9b4bb387473a9fd227a51ae7de5e9 , < 51318d644c993b3f7a60b8616a6a5adc1e967cd2 (git)
Affected: 695846047aa9b4bb387473a9fd227a51ae7de5e9 , < 9c41d2a2aa3817946eb613522200cab55513ddaa (git)
Affected: 695846047aa9b4bb387473a9fd227a51ae7de5e9 , < 3b9935586a9b54d2da27901b830d3cf46ad66a1e (git)
Create a notification for this product.
Linux Linux Affected: 4.19
Unaffected: 0 , < 4.19 (semver)
Unaffected: 6.1.142 , ≤ 6.1.* (semver)
Unaffected: 6.6.95 , ≤ 6.6.* (semver)
Unaffected: 6.12.35 , ≤ 6.12.* (semver)
Unaffected: 6.15.4 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:52.511Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microchip/lan743x_ethtool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b4201d74d0a49af2123abf2c9d142e59566714b",
              "status": "affected",
              "version": "695846047aa9b4bb387473a9fd227a51ae7de5e9",
              "versionType": "git"
            },
            {
              "lessThan": "088279ff18cdc437d6fac5890e0c52c624f78a5b",
              "status": "affected",
              "version": "695846047aa9b4bb387473a9fd227a51ae7de5e9",
              "versionType": "git"
            },
            {
              "lessThan": "51318d644c993b3f7a60b8616a6a5adc1e967cd2",
              "status": "affected",
              "version": "695846047aa9b4bb387473a9fd227a51ae7de5e9",
              "versionType": "git"
            },
            {
              "lessThan": "9c41d2a2aa3817946eb613522200cab55513ddaa",
              "status": "affected",
              "version": "695846047aa9b4bb387473a9fd227a51ae7de5e9",
              "versionType": "git"
            },
            {
              "lessThan": "3b9935586a9b54d2da27901b830d3cf46ad66a1e",
              "status": "affected",
              "version": "695846047aa9b4bb387473a9fd227a51ae7de5e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microchip/lan743x_ethtool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices\n\nMaximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb\nand 64 Kb respectively. Adjust max size definitions and return correct\nEEPROM length based on device. Also prevent out-of-bound read/write."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable accessors are reachable only through the `SIOCETHTOOL` ioctl (`ETHTOOL_GEEPROM`/`ETHTOOL_SEEPROM`) issued on a local socket against a local lan743x/PCI11x1x netdev. There is no packet-driven or remote path into `lan743x_hs_otp_*`/`lan743x_hs_eeprom_*`.\nAC:L - The attacker simply supplies the offset and length fields in `struct ethtool_eeprom`; the per-byte loop then walks the device address space deterministically. No race, timing window, or memory-layout condition outside the attacker\u0027s control is involved.\nPR:L - The gate is `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)` in `__dev_ethtool()`, a namespace-relative capability that an unprivileged user holds as root of a user namespace owning the netns, and physical NICs are routinely delegated to such containers. This is not real root in the initial namespace.\nUI:N - The attacker drives the whole sequence from their own process with a socket and one ioctl. No action by any other user or victim is required.\nS:U - The unchecked accesses stay within the kernel driver\u0027s own authority over the device it already manages; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The missing `offset + length` validation lets `lan743x_hs_otp_read()`/`lan743x_hs_eeprom_read()` read kilobytes of device OTP/EEPROM outside the region the interface is meant to expose, and the ethtool core copies every byte back to userspace via `copy_to_user()`. The disclosure is not bounded to a few bytes.\nI:H - The same unvalidated offset drives `lan743x_hs_otp_write()`/`lan743x_hs_eeprom_write()`, producing out-of-bounds writes into device non-volatile storage; because OTP programming blows fuses irreversibly (and the 10-bit address mask aliases out-of-range offsets onto live rows), device-stored MAC/PHY provisioning is permanently and unauthorizedly altered.\nA:H - Out-of-bounds programming of the OTP/EEPROM leaves the NIC with invalid stored configuration, so the driver fails to bring the interface up and network connectivity is lost. Since blown OTP fuses cannot be cleared, this denial of service is permanent and persists across reboot and driver reload."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:46.048Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b4201d74d0a49af2123abf2c9d142e59566714b"
        },
        {
          "url": "https://git.kernel.org/stable/c/088279ff18cdc437d6fac5890e0c52c624f78a5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/51318d644c993b3f7a60b8616a6a5adc1e967cd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c41d2a2aa3817946eb613522200cab55513ddaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b9935586a9b54d2da27901b830d3cf46ad66a1e"
        }
      ],
      "title": "net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38422",
    "datePublished": "2025-07-25T14:16:43.109Z",
    "dateReserved": "2025-04-16T04:51:24.014Z",
    "dateUpdated": "2026-08-05T12:01:46.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38422",
      "date": "2026-08-05",
      "epss": "0.00164",
      "percentile": "0.06059"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:00:54.000Z",
      "cve": "CVE-2025-38422",
      "id": "msrc_CVE-2025-38422",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38422.json",
      "version": "5"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38422\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T15:15:27.037\",\"lastModified\":\"2026-07-30T06:23:13.383\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices\\n\\nMaximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb\\nand 64 Kb respectively. Adjust max size definitions and return correct\\nEEPROM length based on device. Also prevent out-of-bound read/write.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net:lan743x: Modificar el tama\u00f1o de la EEPROM y el OTP para dispositivos PCI1xxxx. El tama\u00f1o m\u00e1ximo de OTP y EEPROM para dispositivos Hearthstone PCI1xxxx es de 8 Kb y 64 Kb, respectivamente. Ajustar las definiciones de tama\u00f1o m\u00e1ximo y devolver la longitud correcta de la EEPROM seg\u00fan el dispositivo. Tambi\u00e9n se evita la lectura/escritura fuera de los l\u00edmites.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/microchip/lan743x_ethtool.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"695846047aa9b4bb387473a9fd227a51ae7de5e9\",\"lessThan\":\"6b4201d74d0a49af2123abf2c9d142e59566714b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"695846047aa9b4bb387473a9fd227a51ae7de5e9\",\"lessThan\":\"088279ff18cdc437d6fac5890e0c52c624f78a5b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"695846047aa9b4bb387473a9fd227a51ae7de5e9\",\"lessThan\":\"51318d644c993b3f7a60b8616a6a5adc1e967cd2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"695846047aa9b4bb387473a9fd227a51ae7de5e9\",\"lessThan\":\"9c41d2a2aa3817946eb613522200cab55513ddaa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"695846047aa9b4bb387473a9fd227a51ae7de5e9\",\"lessThan\":\"3b9935586a9b54d2da27901b830d3cf46ad66a1e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/microchip/lan743x_ethtool.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.142\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.95\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.35\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.4\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19\",\"versionEndExcluding\":\"6.1.142\",\"matchCriteriaId\":\"8B2729C5-8562-475A-A558-477E45FE2F7B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.95\",\"matchCriteriaId\":\"C5E01853-7048-4D78-9479-9AEE41AC8456\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.35\",\"matchCriteriaId\":\"E569FD34-0076-4428-BE17-EECCF867611C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.4\",\"matchCriteriaId\":\"DFD174C5-1AA2-4671-BDDC-1A9FCC753655\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/088279ff18cdc437d6fac5890e0c52c624f78a5b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3b9935586a9b54d2da27901b830d3cf46ad66a1e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/51318d644c993b3f7a60b8616a6a5adc1e967cd2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6b4201d74d0a49af2123abf2c9d142e59566714b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9c41d2a2aa3817946eb613522200cab55513ddaa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:09:09+00:00",
      "cve": "CVE-2025-38422",
      "id": "CVE-2025-38422",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38422.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:09:54Z",
      "cve": "CVE-2025-38422",
      "id": "CVE-2025-38422",
      "initial_release_date": "2025-07-29T23:23:47Z",
      "product_status:known_affected": "178",
      "product_status:known_not_affected": "163",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38422",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38422.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.