{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38398", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.012Z", "datePublished": "2025-07-25T12:53:42.398Z", "dateUpdated": "2026-08-05T12:01:35.281Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:35.281Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-qpic-snand: reallocate BAM transactions\n\nUsing the mtd_nandbiterrs module for testing the driver occasionally\nresults in weird things like below.\n\n1. swiotlb mapping fails with the following message:\n\n [ 85.926216] qcom_snand 79b0000.spi: swiotlb buffer is full (sz: 4294967294 bytes), total 512 (slots), used 0 (slots)\n [ 85.932937] qcom_snand 79b0000.spi: failure in mapping desc\n [ 87.999314] qcom_snand 79b0000.spi: failure to write raw page\n [ 87.999352] mtd_nandbiterrs: error: write_oob failed (-110)\n\n Rebooting the board after this causes a panic due to a NULL pointer\n dereference.\n\n2. If the swiotlb mapping does not fail, rebooting the board may result\n in a different panic due to a bad spinlock magic:\n\n [ 256.104459] BUG: spinlock bad magic on CPU#3, procd/2241\n [ 256.104488] Unable to handle kernel paging request at virtual address ffffffff0000049b\n ...\n\nInvestigating the issue revealed that these symptoms are results of\nmemory corruption which is caused by out of bounds access within the\ndriver.\n\nThe driver uses a dynamically allocated structure for BAM transactions,\nwhich structure must have enough space for all possible variations of\ndifferent flash operations initiated by the driver. The required space\nheavily depends on the actual number of 'codewords' which is calculated\nfrom the pagesize of the actual NAND chip.\n\nAlthough the qcom_nandc_alloc() function allocates memory for the BAM\ntransactions during probe, but since the actual number of 'codewords'\nis not yet know the allocation is done for one 'codeword' only.\n\nBecause of this, whenever the driver does a flash operation, and the\nnumber of the required transactions exceeds the size of the allocated\narrays the driver accesses memory out of the allocated range.\n\nTo avoid this, change the code to free the initially allocated BAM\ntransactions memory, and allocate a new one once the actual number of\n'codewords' required for a given NAND chip is known." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The overflow is reached through local NAND flash I/O — filesystem reads/writes on the flash-backed UBIFS rootfs or MTD char/block device access — not through any network-facing interface.\nAC:L - On affected Qualcomm QPIC SPI NAND hardware the arrays are undersized by a factor of cwperpage (4 for a 2K page), so every single page read or write deterministically overruns them; there is no race and no memory-layout condition outside the attacker's control.\nPR:L - An unprivileged local user triggers flash page operations simply by reading files that miss the page cache on the NAND-backed filesystem; no capability check gates qcom_spi_read_page()/write_page().\nUI:N - No victim action is required — the corruption occurs during the attacker's own flash I/O, and in fact happens during ordinary system operation.\nS:U - The out-of-bounds writes corrupt kernel heap within the same security authority; the BAM DMA is issued by the kernel itself and no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Out-of-bounds scatterlist entries built past the allocation are consumed by the BAM DMA engine, causing DMA transfers described by adjacent heap garbage, which can disclose arbitrary kernel memory into flash buffers readable by the attacker.\nI:H - This is an unchecked heap out-of-bounds write of pointer-and-length scatterlist structures kilobytes past a ~2K slab object, corrupting adjacent kernel objects and steering DMA writes to attacker-influenced addresses — a strong write primitive suitable for control-flow hijacking.\nA:H - The corruption reliably produces kernel panics, as demonstrated by the reported swiotlb failure with a bogus 4294967294-byte size, \"spinlock bad magic\", and an unhandled paging request at ffffffff0000049b." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/spi/spi-qpic-snand.c" ], "versions": [ { "version": "7304d1909080ef0c9da703500a97f46c98393fcd", "lessThan": "86fb36de1132b560f9305f0c78fa69f459fa0980", "status": "affected", "versionType": "git" }, { "version": "7304d1909080ef0c9da703500a97f46c98393fcd", "lessThan": "d85d0380292a7e618915069c3579ae23c7c80339", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/spi/spi-qpic-snand.c" ], "versions": [ { "version": "6.15", "status": "affected" }, { "version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.6", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.15.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/86fb36de1132b560f9305f0c78fa69f459fa0980" }, { "url": "https://git.kernel.org/stable/c/d85d0380292a7e618915069c3579ae23c7c80339" } ], "title": "spi: spi-qpic-snand: reallocate BAM transactions", "x_generator": { "engine": "bippy-1.2.0" } } } }