CVE-2025-38090: drivers/rapidio/rio_cm.c: prevent possible heap overwrite
In the Linux kernel, the following vulnerability has been resolved:
drivers/rapidio/riocm.c: prevent possible heap overwrite
In
riocmcdevioctl(RIOCMCHANSEND) -> cmchanmsgsend() -> riocmchsend()
cmchanmsgsend() checks that userspace didn't send too much data but riocmchsend() failed to check that userspace sent sufficient data. The result is that riocmchsend() can write to fields in the riochchanhdr which were outside the bounds of the space which cmchanmsgsend() allocated.
Address this by teaching riocmchsend() to check that the entire riochchanhdr was copied in from userspace.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38090?
CVE-2025-38090 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38090?
To fix CVE-2025-38090, update your Linux kernel to the latest patched version provided by your distribution.
What type of vulnerability is CVE-2025-38090?
CVE-2025-38090 is a heap overwrite vulnerability that can occur in the Linux kernel's rio_cm.c driver.
Which systems are affected by CVE-2025-38090?
CVE-2025-38090 affects the Linux kernel across all versions that include the vulnerable rio_cm.c driver.
What is the impact of CVE-2025-38090?
Exploitation of CVE-2025-38090 could lead to potential corruption of memory and cause denial of service or arbitrary code execution.