CVE-2025-38003: can: bcm: add missing rcu read protection for procfs content
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: add missing rcu read protection for procfs content
When the procfs content is generated for a bcmop which is in the process to be removed the procfs output might show unreliable data (UAF).
As the removal of bcmop's is already implemented with rcu handling this patch adds the missing rcureadlock() and makes sure the list entries are properly removed under rcu protection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (bcm)to a version that resolves this vulnerability.Patch can: bcm: add missing rcu read protection for procfs content
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38003?
CVE-2025-38003 is classified as a medium severity vulnerability due to the potential for unreliable data exposure.
How do I fix CVE-2025-38003?
To fix CVE-2025-38003, update your Linux kernel to the latest version that patches this vulnerability.
What type of vulnerability is CVE-2025-38003?
CVE-2025-38003 is a use-after-free (UAF) vulnerability affecting the Linux kernel's procfs content generation.
Which versions of the Linux kernel are affected by CVE-2025-38003?
CVE-2025-38003 affects certain versions of the Linux kernel prior to the patch release that addresses this issue.
What are the potential impacts of CVE-2025-38003?
The potential impacts of CVE-2025-38003 include exposure to unreliable data from procfs, which can lead to security risks.