Skip to main content

Linux Kernel CVE-2025-38426

MEDIUM
2025-07-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Memory Corruption Red Hat Linux Kernel Suse
5.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Impact

Multiple signals suggest this is a low-priority vulnerability despite the moderate CVSS 5.5 score. CVSS analysis shows attack vector is Local (AV:L), access complexity is Low (AC:L), and privilege requirement is Low (PR:L), meaning only local authenticated users can trigger the flaw; remote attackers cannot exploit this. The EPSS score of 0.02% places this in the 5th percentile, indicating minimal real-world exploitation likelihood-a substantial gap from the CVSS rating. No CISA KEV (known exploited vulnerability) status is indicated, and no public proof-of-concept has been identified. The impact is denial of service only (A:H for availability, C:N and I:N for confidentiality and integrity), with no data breach or privilege escalation risk. Under SSVC, the low privilege barrier, lack of active exploitation data, and DoS-only impact classify this as a lower-priority patch candidate compared to higher-EPSS or remotely-exploitable flaws. Organizations should prioritize kernel updates addressing higher-risk CVEs first, but should patch this during routine maintenance cycles.
Exploit ScenarioDerived

A local, authenticated user on a system with an AMD GPU can read a maliciously crafted or corrupted EEPROM header through the amdgpu driver's RAS telemetry interface. By supplying a header with an extremely large record count or record size field, the attacker triggers a kernel memory allocation attempt for a multi-gigabyte buffer, causing the system to exhaust free memory, trigger the out-of-memory killer, and deny service to legitimate workloads. No special elevation or kernel vulnerability chain is required; standard user privileges suffice because the EEPROM interface is accessible to local processes. No public proof-of-concept has been identified at the time of analysis.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 25, 2026

Linux kernel RAS (Reliability, Availability, Serviceability) header validation in the AMD GPU driver (amdgpu) lacks input sanitization, allowing a local authenticated attacker to trigger denial of service through excessive memory allocation when reading corrupted EEPROM data. The vulnerability affects all Linux kernel versions with the vulnerable amdgpu driver code path and requires local access with standard user privileges. No public exploit code has been identified; the EPSS score of 0.02% (5th percentile) indicates low real-world exploitation probability despite the moderate CVSS 5.5 rating.

RemediationAI

Apply the upstream Linux kernel patch by updating to a kernel version that includes one or more of the referenced commits (0479268fdfaaff6e15d69e8a8387410f36d1b793, 5df0d6addb7e9b6f71f7162d1253762a5be9138e, b52f52bc5ba9feb026c0be600f8ac584fd12d187, or e1903358b2152f5d64a83e796bb776aba0d3628d). Coordinate with your Linux distribution vendor to identify the specific kernel release version that includes these commits; patches are tracked in the upstream kernel source tree at https://git.kernel.org/stable/. Until a patched kernel can be deployed, restrict local system access to trusted users only and disable GPU RAS monitoring features if available in the driver configuration. Organizations running AMD GPU workloads should schedule kernel updates during the next maintenance window, prioritizing this after higher-risk CVE patches.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The amdgpu driver in the Linux kernel interfaces with GPU-resident EEPROM storage to read Reliability, Availability, and Serviceability (RAS) telemetry records. The vulnerability exists in the RAS header parsing logic, specifically the code that reads and validates header fields before allocating memory buffers for RAS record data. When an EEPROM header is corrupted or maliciously crafted, the lack of bounds checking on header fields (likely record count, record size, or total buffer size fields) could cause the kernel to attempt allocation of unusually large memory regions. This is a classic integer overflow or lack-of-bounds-validation vulnerability (analogous to CWE-190 or CWE-190-adjacent integer handling flaws) that manifests as resource exhaustion. The affected product is the Linux kernel (CPE:cpe:2.3:o:linux:linux_kernel) across all versions containing the vulnerable amdgpu driver code.

Know when Linux Kernel gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Mar 25, 2026 - 11:22 nvd
Patch available
CVE Published
Jul 25, 2025 - 15:15 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Add basic validation for RAS header

If RAS header read from EEPROM is corrupted, it could result in trying to allocate huge memory for reading the records. Add some validation to header fields.

Executive ViewAI

Why It Matters

CVE-2025-38426 presents moderate security risk rated CVSS 5.5. Exploitation could compromise the security of affected deployments. A patch is available and should be applied during regular vulnerability management.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
3 sources
Confidence: Low
NVD CVE.org EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Low

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

More in Linux Kernel

View all
CVE-2022-0847 HIGH POC
7.8 Mar 10

Linux kernel contains a flaw known as 'Dirty Pipe' where improper pipe buffer flag initialization allows unprivileged lo
CVE-2015-1328 HIGH POC
7.8 Nov 28

The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no
CVE-2017-7308 HIGH POC
7.8 Mar 29

The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate cer
CVE-2017-16995 HIGH POC
7.8 Dec 27

The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial

CVE-2017-1000112 HIGH POC
7.0 Oct 05

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. Rated high severity (CVSS 7.0). Public ex
CVE-2015-8660 MEDIUM POC
6.7 Dec 28

The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr op
CVE-2012-0056 MEDIUM POC
6.9 Jan 27

The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when
CVE-2014-0038 MEDIUM POC
6.9 Feb 06

The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allo
CVE-2016-8655 HIGH POC
7.8 Dec 08

Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau
CVE-2016-0728 HIGH POC
7.8 Feb 08

The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object ref
CVE-2017-0561 CRITICAL POC
9.8 Apr 07

A remote code execution vulnerability in the Broadcom Wi-Fi firmware could enable a remote attacker to execute arbitrary
CVE-2016-10277 HIGH POC
7.8 May 12

An elevation of privilege vulnerability in the Motorola bootloader could enable a local malicious application to execute

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.44 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.27 Image SL-Micro Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.67 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.29 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.76 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.14 Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-GCE Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-GCE Affected

References

Advisories & patches
PATCH https://git.kernel.org/stable/c/5df0d6addb7e9b6f71f7162d1253762a5be9138e PATCH https://git.kernel.org/stable/c/b52f52bc5ba9feb026c0be600f8ac584fd12d187 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02853/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02923/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02969/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02996/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02997/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03011/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03023/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20577/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20586/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20601/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20602/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20994/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20996/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21074/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21139/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21179/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20309/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20330/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20560/ REF https://git.kernel.org/stable/c/0479268fdfaaff6e15d69e8a8387410f36d1b793 REF https://git.kernel.org/stable/c/e1903358b2152f5d64a83e796bb776aba0d3628d

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy