{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38197", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.993Z", "datePublished": "2025-07-04T13:37:19.926Z", "dateUpdated": "2026-08-05T12:00:19.209Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:00:19.209Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell_rbu: Fix list usage\n\nPass the correct list head to list_for_each_entry*() when looping through\nthe packet list.\n\nWithout this patch, reading the packet data via sysfs will show the data\nincorrectly (because it starts at the wrong packet), and clearing the\npacket list will result in a NULL pointer dereference." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "baseScore": 7.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is only reachable through sysfs files under /sys/devices/platform/dell_rbu/ (data, image_type, packet_size); there is no network or remote data path into dell_rbu.\nAC:L - No race, no memory-layout dependency, and no non-deterministic condition — the wrong list head is used unconditionally, so reading data at the right offset always returns uninitialized heap and clearing the packet list always dereferences NULL.\nPR:L - BIN_ATTR_RO(data, 0) yields mode 0444, so any unprivileged local user can read /sys/devices/platform/dell_rbu/data and harvest the disclosed kernel heap memory once a BIOS update has populated the packet list.\nUI:N - Once the driver is in packet mode with an image loaded — its documented operating state during a Dell BIOS update — the attacker triggers the flaw entirely on their own by reading the sysfs file, with no victim action required.\nS:U - Both the faulty traversal and its consequences are confined to the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - read_packet_data() reports more bytes than packet_read_list() actually wrote, so kernfs copies up to a full page of uninitialized kmalloc'd slab memory to an unprivileged reader, repeatably — an effectively unbounded kernel-memory read primitive.\nI:L - The traversal list_del()s and poisons the static packet_data_head, and leaves packet #1 permanently allocated, uncached, and un-zeroed — the exact stale-RBU-packet-in-memory state the code deliberately scrubs before a BIOS flash — but yields no controllable write primitive.\nA:H - packet_empty_list() executes memset(NULL, 0, packetsize), oopsing while rbu_data.lock is held, so the spinlock is never released and every subsequent access to any dell_rbu sysfs file spins forever, hanging CPUs." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/platform/x86/dell/dell_rbu.c" ], "versions": [ { "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "5e8c658acd1b7c186aeffa46bf08795e121f401a", "status": "affected", "versionType": "git" }, { "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "07d7b8e7ef7d1f812a6211ed531947c56d09e95e", "status": "affected", "versionType": "git" }, { "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "a7b477b64ef5e37cb08dd536ae07c46f9f28262e", "status": "affected", "versionType": "git" }, { "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "f3b840fb1508a80cd8a0efb5c886ae1995a88b24", "status": "affected", "versionType": "git" }, { "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "4d71f2c1e5263a9f042faa71d59515709869dc79", "status": "affected", "versionType": "git" }, { "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "32d05e6cc3a7bf6c8f16f7b7ef8fe80eca0c233e", "status": "affected", "versionType": "git" }, { "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "61ce04601e0d8265ec6d2ffa6df5a7e1bce64854", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/platform/x86/dell/dell_rbu.c" ], "versions": [ { "version": "5.7", "status": "affected" }, { "version": "0", "lessThan": "5.7", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.239", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.186", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.142", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.95", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.35", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.4", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.10.239" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.15.186" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.1.142" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.6.95" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.12.35" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.15.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5e8c658acd1b7c186aeffa46bf08795e121f401a" }, { "url": "https://git.kernel.org/stable/c/07d7b8e7ef7d1f812a6211ed531947c56d09e95e" }, { "url": "https://git.kernel.org/stable/c/a7b477b64ef5e37cb08dd536ae07c46f9f28262e" }, { "url": "https://git.kernel.org/stable/c/f3b840fb1508a80cd8a0efb5c886ae1995a88b24" }, { "url": "https://git.kernel.org/stable/c/4d71f2c1e5263a9f042faa71d59515709869dc79" }, { "url": "https://git.kernel.org/stable/c/32d05e6cc3a7bf6c8f16f7b7ef8fe80eca0c233e" }, { "url": "https://git.kernel.org/stable/c/61ce04601e0d8265ec6d2ffa6df5a7e1bce64854" } ], "title": "platform/x86: dell_rbu: Fix list usage", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:35:21.012Z" } } ] } }