CVE-2025-38277: mtd: nand: ecc-mxic: Fix use of uninitialized variable ret
In the Linux kernel, the following vulnerability has been resolved:
mtd: nand: ecc-mxic: Fix use of uninitialized variable ret
If ctx->steps is zero, the loop processing ECC steps is skipped, and the variable ret remains uninitialized. It is later checked and returned, which leads to undefined behavior and may cause unpredictable results in user space or kernel crashes.
This scenario can be triggered in edge cases such as misconfigured geometry, ECC engine misuse, or if ctx->steps is not validated after initialization.
Initialize ret to zero before the loop to ensure correct and safe behavior regardless of the ctx->steps value.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38277?
CVE-2025-38277 has been classified with a severity rating that indicates a potential risk due to the use of an uninitialized variable.
How do I fix CVE-2025-38277?
To fix CVE-2025-38277, update to the latest version of the Linux kernel that addresses this vulnerability.
What systems are affected by CVE-2025-38277?
CVE-2025-38277 affects versions of the Linux kernel that utilize the MTD NAND subsystem.
What is the impact of CVE-2025-38277?
The impact of CVE-2025-38277 could lead to unexpected behavior due to the use of an uninitialized variable in ECC processing.
Is there a patch available for CVE-2025-38277?
Yes, a patch for CVE-2025-38277 is included in the latest stable releases of the Linux kernel.