CVE-2025-38336: ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
In the Linux kernel, the following vulnerability has been resolved:
ata: patavia: Force PIO for ATAPI devices on VT6415/VT6330
The controller has a hardware bug that can hard hang the system when doing ATAPI DMAs without any trace of what happened. Depending on the device attached, it can also prevent the system from booting.
In this case, the system hangs when reading the ATIP from optical media with cdrecord -vvv -atip on an NEC DVDRW ND-4571A 1-01 and an Optiarc DVD RW AD-7200A 1.06 attached to an ASRock 990FX Extreme 4, running at UDMA/33.
The issue can be reproduced by running the same command with a cygwin build of cdrecord on WinXP, although it requires more attempts to cause it. The hang in that case is also resolved by forcing PIO. It doesn't appear that VIA has produced any drivers for that OS, thus no known workaround exists.
HDDs attached to the controller do not suffer from any DMA issues.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Configuration
Force PIO for ATAPI devices on VT6415/VT6330 controllers to prevent hangs caused by ATAPI DMA.
Linux kernel ata: pata_via on VT6415/VT6330 ATAPI transfer mode = PIO
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38336?
CVE-2025-38336 is classified as a high severity vulnerability due to its potential to hard hang the system.
How do I fix CVE-2025-38336?
To fix CVE-2025-38336, ensure that you update your Linux kernel to a version that addresses this vulnerability.
What systems are affected by CVE-2025-38336?
CVE-2025-38336 affects systems using the Linux kernel with VT6415 and VT6330 controllers.
What happens if CVE-2025-38336 is exploited?
Exploitation of CVE-2025-38336 can result in the system experiencing a hard hang during ATAPI DMAs without generating trace logs.
Is there a known workaround for CVE-2025-38336?
Currently, the best workaround for CVE-2025-38336 is to avoid using affected hardware configurations until the kernel is updated.