CVE-2025-38173: crypto: marvell/cesa - Handle zero-length skcipher requests
In the Linux kernel, the following vulnerability has been resolved:
crypto: marvell/cesa - Handle zero-length skcipher requests
Do not access random memory for zero-length skcipher requests. Just return 0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38173?
CVE-2025-38173 has been classified as a moderate severity vulnerability affecting the Linux kernel.
How do I fix CVE-2025-38173?
To mitigate CVE-2025-38173, upgrade to the latest version of the Linux kernel that includes the fix.
What impact does CVE-2025-38173 have on systems?
CVE-2025-38173 can potentially lead to accessing random memory, which may result in undefined behavior or system instability.
Which versions of the Linux kernel are affected by CVE-2025-38173?
CVE-2025-38173 affects multiple versions of the Linux kernel before the fix was applied.
What is the nature of the vulnerability described in CVE-2025-38173?
CVE-2025-38173 relates to improper handling of zero-length skcipher requests in the Linux kernel's crypto subsystem.