CVE-2025-38667: iio: fix potential out-of-bound write
In the Linux kernel, the following vulnerability has been resolved:
iio: fix potential out-of-bound write
The buffer is set to 20 characters. If a caller write more characters, count is truncated to the max available space in "simplewritetobuffer". To protect from OoB access, check that the input size fit into buffer and add a zero terminator after copy to the end of the copied data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the iio code path, truncate `count` to the maximum available space when writing via `simple_write_to_buffer` to prevent out-of-bounds writes.
Linux kernel iio simple_write_to_buffer (input size handling) = truncate count to max available space - Configuration
In the iio implementation, set the buffer to 20 characters, add a check that the input size fits into the buffer, and add a zero terminator after the copied data.
Linux kernel iio iio buffer write (copy and termination) = 20-character buffer with bounds check and explicit NUL termination
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38667?
CVE-2025-38667 has a critical severity level due to the potential for out-of-bounds write vulnerabilities in the Linux kernel.
How do I fix CVE-2025-38667?
To fix CVE-2025-38667, update your Linux kernel to version 6.15.10 or later to ensure the patch is applied.
Which Linux kernel versions are affected by CVE-2025-38667?
CVE-2025-38667 affects Linux kernel versions from 6.15 to 6.16-rc6.
What does CVE-2025-38667 expose systems to?
CVE-2025-38667 exposes systems to risks of memory corruption, which could potentially lead to privilege escalation or denial of service.
Who should be concerned about CVE-2025-38667?
Developers and administrators using affected versions of the Linux kernel should prioritize applying updates to mitigate the risks associated with CVE-2025-38667.