CVE-2025-38548: hwmon: (corsair-cpro) Validate the size of the received input buffer
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (corsair-cpro) Validate the size of the received input buffer
Add bufferrecvsize to store the size of the received bytes. Validate bufferrecvsize in sendusbcmd().
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38548?
The severity of CVE-2025-38548 is categorized as medium due to potential buffer overflow risks.
How do I fix CVE-2025-38548?
To fix CVE-2025-38548, update the Linux kernel to the latest stable version where the vulnerability has been resolved.
What systems are affected by CVE-2025-38548?
CVE-2025-38548 affects the Linux kernel, particularly versions that include the hwmon subsystem for Corsair devices.
Can CVE-2025-38548 be exploited remotely?
Yes, CVE-2025-38548 could potentially be exploited remotely if an attacker has access to the vulnerable hwmon interface.
What should I do if I cannot update my Linux kernel for CVE-2025-38548?
If unable to update the kernel, consider disabling the specific hwmon driver for affected devices as a temporary mitigation.