CVE-2025-38332: scsi: lpfc: Use memcpy() for BIOS version
In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Use memcpy() for BIOS version
The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is passed in.
Anyway, instead of memset() with 0 followed by a strlcat(), just use memcpy() and ensure that the resulting buffer is NULL terminated.
BIOSVersion is only used for the lpfcprintflog() which expects a properly terminated string.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38332?
CVE-2025-38332 has a moderate severity level due to its potential to cause panic in the system.
How do I fix CVE-2025-38332?
To fix CVE-2025-38332, you should apply the latest Linux kernel updates that address this vulnerability.
What systems are affected by CVE-2025-38332?
CVE-2025-38332 affects the Linux kernel, specifically the SCSI lpfc driver.
What is the nature of the vulnerability in CVE-2025-38332?
The vulnerability in CVE-2025-38332 is caused by improper handling of buffer sizes in strlcat(), leading to potential kernel panic.
Is there a patch available for CVE-2025-38332?
Yes, there are patches available in the updates for the Linux kernel that resolve CVE-2025-38332.