7.8

CVE-2025-38401: debian debian_linux Out-of-bounds Write

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2025-38401DEBIAN-CVE-2025-38401
Published 25-07-2025Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2025-38401 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.3% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.19%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 53 · Related 47
DLA-4327-1DLA-4328-1DSA-5973-1LSN-0122-1MGASA-2025-0218MGASA-2025-0219

Timeline

  1. 25-07-2025
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: mtk-sd: Prevent memory corruption from DMA map failure If msdc_prepare_data() fails to map the DMA region, the request is not prepared for data receiving, but msdc_start_data() proceeds the DMA with previous setting. Since this will lead a memory corruption, we have to stop the request operation soon after the msdc_prepare_data() fails to prepare it.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.19%

Chance of exploitation in the next 30 days

Percentile

8%

Versus all other CVEs

30-day change

+0.02 pp

From 0.17% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.19%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu146 products
  • linuxAll versions (No fix recorded) | < 5.15.0-156.166 | < 6.8.0-100.100
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1092.99 | < 6.8.0-1046.49
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
Linux2 products
  • linux≥ 208489032bdd8d4a7de50f3057c175058f271956, < 5ac9e9e2e9cd6247d8c2d99780eae4556049e1cc | ≥ 208489032bdd8d4a7de50f3057c175058f271956, < d54771571f74a82c59830a32e76af78a8e57ac69 | ≥ 208489032bdd8d4a7de50f3057c175058f271956, < 48bf4f3dfcdab02b22581d8e350a2d23130b72c0 | ≥ 208489032bdd8d4a7de50f3057c175058f271956, < 63e8953f16acdcb23e2d4dd8a566d3c34df3e200 | ≥ 208489032bdd8d4a7de50f3057c175058f271956, < 61cdd663564674ea21ceb50aa9d3697cbe9e45f9 | ≥ 208489032bdd8d4a7de50f3057c175058f271956, < 3419bc6a7b65cbbb91417bb9970208478e034c79 | ≥ 208489032bdd8d4a7de50f3057c175058f271956, < a5f5f67b284d81776d4a3eb1f8607e4b7f91f11c | ≥ 208489032bdd8d4a7de50f3057c175058f271956, < f5de469990f19569627ea0dd56536ff5a13beaa3 | 4.2
  • linux_kernel≥ 4.2, < 5.4.296 | ≥ 5.5, < 5.10.240 | ≥ 5.11, < 5.15.187 | ≥ 5.16, < 6.1.144 | ≥ 6.2, < 6.6.97 | ≥ 6.7, < 6.12.37 | ≥ 6.13, < 6.15.6 | 6.16:rc1 | 6.16:rc2 | 6.16:rc3 | 6.16:rc4

3 vendors · 150 products

References

46 links
Show all 46 references