CVE-2025-38401: mtk-sd: Prevent memory corruption from DMA map failure
In the Linux kernel, the following vulnerability has been resolved:
mtk-sd: Prevent memory corruption from DMA map failure
If msdcpreparedata() fails to map the DMA region, the request is not prepared for data receiving, but msdcstartdata() proceeds the DMA with previous setting. Since this will lead a memory corruption, we have to stop the request operation soon after the msdcpreparedata() fails to prepare it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the mtk-sd driver, stop the request operation immediately when msdc_prepare_data() fails to map or prepare the DMA region, so msdc_start_data() does not proceed with the previous DMA setting.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38401?
CVE-2025-38401 is classified as a high severity vulnerability due to the potential for memory corruption.
How do I fix CVE-2025-38401?
To fix CVE-2025-38401, update your Linux kernel to the latest version where the vulnerability has been resolved.
What types of systems are affected by CVE-2025-38401?
CVE-2025-38401 affects systems running the Linux kernel, specifically those using the mtk-sd driver.
What is the impact of CVE-2025-38401 on systems?
The impact of CVE-2025-38401 includes potential memory corruption, leading to system instability or crashes.
When was CVE-2025-38401 disclosed?
CVE-2025-38401 was disclosed following the identification of the vulnerability in the Linux kernel's mtk-sd driver.