CVE-2025-38342: software node: Correct a OOB check in software_node_get_reference_args()
In the Linux kernel, the following vulnerability has been resolved:
software node: Correct a OOB check in softwarenodegetreferenceargs()
softwarenodegetreferenceargs() wants to get @index-th element, so the property value requires at least '(index + 1) sizeof(ref)' bytes but that can not be guaranteed by current OOB check, and may cause OOB for malformed property.
Fix by using as OOB check '((index + 1) sizeof(ref) > prop->length)'.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Configuration
Use the OOB check '((index + 1) * sizeof(*ref) > prop->length)' before accessing the index-th element.
Linux kernel software_node_get_reference_args() out-of-bounds check = (index + 1) * sizeof(*ref) > prop->length
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38342?
CVE-2025-38342 has been assigned a medium severity level due to its potential impact on system stability.
How do I fix CVE-2025-38342?
To fix CVE-2025-38342, update your Linux kernel to the latest stable version that includes the patch for this vulnerability.
What systems are affected by CVE-2025-38342?
CVE-2025-38342 affects specific versions of the Linux kernel, particularly those that use the software node functionality.
What type of vulnerability is CVE-2025-38342?
CVE-2025-38342 is an out-of-bounds (OOB) vulnerability affecting the software_node_get_reference_args() function.
Is there any known exploit for CVE-2025-38342?
As of now, there are no public reports of active exploits leveraging CVE-2025-38342.