CVE-2025-38077: debian debian_linux Out-of-bounds Write

Vulnerability summary

CVE-2025-38077 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.8% of scored vulnerabilities.

Timeline

1. 18-06-2025
   PublishedVulnerability first disclosed.
2. 11-05-2026
   Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() If the 'buf' array received from the user contains an empty string, the 'length' variable will be zero. Accessing the 'buf' array element with index 'length - 1' will result in a buffer overflow. Add a check for an empty string. Found by Linux Verification Center (linuxtesting.org) with SVACE.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.