What is the CVSS score of CVE-2025-38422?

CVE-2025-38422 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2025-38422?

Systems using Microchip PCI1xxxx Ethernet controllers in Linux environments are vulnerable to local privilege escalation through the kernel's lan743x network driver, allowing unprivileged users to…. A patch is available.

How to fix or mitigate CVE-2025-38422?

Within 24 hours: identify all systems running Microchip PCI1xxxx Ethernet controllers using lspci, hardware inventory tools, or asset management systems to search for 'Microchip' or 'PCI1xxx' devices, and notify system owners. Within 7 days: consult your Linux distribution's security advisories to obtain the patched kernel version and develop a deployment plan with system owners. Within 30 days: apply the vendor-released kernel patch across all affected systems via your standard change management process, verify successful remediation through configuration scanning, and document completion in your patch management system.

Linux Kernel CVE-2025-38422

HIGH

2025-07-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Debian Red Hat Debian Linux Suse

High

Disputed · 7.8 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local access with low privileges to invoke driver EEPROM/OTP interface (PR:L, AV:L); OOB read/write in kernel yields high C/I/A within unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.6 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H

Red Hat

4.4 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:21 vuln.today

CVE Published

Jul 25, 2025 - 15:15 nvd

HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices

Maximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb and 64 Kb respectively. Adjust max size definitions and return correct EEPROM length based on device. Also prevent out-of-bound read/write.

AnalysisAI

Out-of-bounds read/write in the Linux kernel's lan743x network driver affects systems using Microchip PCI1xxxx (hearthstone) Ethernet controllers, where incorrect OTP (8 Kb) and EEPROM (64 Kb) maximum size definitions allowed access beyond the intended memory bounds during EEPROM/OTP operations. A local user with the ability to invoke the driver's EEPROM/OTP read/write paths could trigger memory corruption, potentially leading to code execution or privilege escalation (CVSS 7.8). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).

Technical ContextAI

The affected component is the lan743x driver in the Linux kernel, which supports Microchip's LAN743x and PCI1xxxx family of PCIe Gigabit Ethernet controllers. These devices expose OTP (one-time-programmable) and EEPROM non-volatile memory accessible through driver ioctl/ethtool interfaces. The bug stems from hardcoded or mismatched maximum size constants that did not match the actual PCI1xxxx hardware limits (8 Kb OTP, 64 Kb EEPROM), so length/offset validation could permit reads or writes past the valid region. This is a classic out-of-bounds memory access (CWE-787 out-of-bounds write / CWE-125 out-of-bounds read), though NVD lists CWE as N/A. The fix adjusts the max size definitions per device and returns the correct EEPROM length, adding bounds checks to prevent the OOB access.

RemediationAI

Update to a Linux kernel build that includes the upstream stable fix; the patch is available as commits git.kernel.org/stable/c/088279ff18cdc437d6fac5890e0c52c624f78a5b, 3b9935586a9b54d2da27901b830d3cf46ad66a1e, 51318d644c993b3f7a60b8616a6a5adc1e967cd2, 6b4201d74d0a49af2123abf2c9d142e59566714b, and 9c41d2a2aa3817946eb613522200cab55513ddaa. Debian users should apply the kernel update referenced in the Debian LTS advisory (https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html). As a compensating control where patching must be deferred, restrict local access on affected hosts and limit which users can invoke ethtool EEPROM/OTP read/write operations on the lan743x interface (these require CAP_NET_ADMIN); on systems that do not use Microchip LAN743x/PCI1xxxx NICs, the driver can be blacklisted (e.g. via modprobe) to remove the attack surface entirely, with the trade-off that any such NIC present would lose networking.

More in Debian Linux

View all

CVE-2021-44228 CRITICAL Act Now POC

10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c

CVE-2019-11043 CRITICAL Emergency POC

9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2012-1823 CRITICAL Act Now POC

9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

CVE-2014-6271 CRITICAL Act Now POC

9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2017-7494 CRITICAL Act Now POC

9.8 May 30

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2025-49113 CRITICAL Act Now POC

9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au

CVE-2022-30333 HIGH Act Now POC

7.5 May 09

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o

CVE-2016-3714 HIGH Act Now POC

8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.

CVE-2017-12617 HIGH Act Now POC

8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT

CVE-2020-1938 CRITICAL Act Now POC

9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate

CVE-2018-7602 CRITICAL Act Now POC

9.8 Jul 19

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2025-38422 vulnerability details – vuln.today

Back

Linux Kernel CVE-2025-38422

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

More in Debian Linux

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code