Skip to main content

Linux Kernel CVE-2025-38484

HIGH
Out-of-bounds Write (CWE-787)
2025-07-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.4 MEDIUM

Local write to IIO debugfs needs some privilege (PR:L, AV:L); a single-byte NUL overflow gives limited integrity/availability impact (I:L/A:L) and no info disclosure (C:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 08:17 vuln.today
CVE Published
Jul 28, 2025 - 12:15 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

iio: backend: fix out-of-bound write

The buffer is set to 80 character. If a caller write more characters, count is truncated to the max available space in "simple_write_to_buffer". But afterwards a string terminator is written to the buffer at offset count without boundary check. The zero termination is written OUT-OF-BOUND.

Add a check that the given buffer is smaller then the buffer to prevent.

AnalysisAI

Out-of-bounds write in the Linux kernel's Industrial I/O (IIO) backend debugfs interface allows a local user with write access to corrupt kernel memory by one byte beyond an 80-character buffer. The flaw affects 6.16 release-candidate kernels (rc1-rc6): after simple_write_to_buffer truncates an oversized write to the buffer size, a NUL string terminator is written at the (already maxed-out) offset without a bounds check. It is fixed upstream and has no public exploit identified at time of analysis; EPSS is very low (0.15%, 5th percentile).

Technical ContextAI

The affected code lives in the IIO (Industrial I/O) subsystem's backend layer (drivers/iio/industrialio-backend.c), which exposes debugfs read/write helpers for IIO backend devices. The write handler uses simple_write_to_buffer() to copy user input into a fixed 80-byte stack/heap buffer; that helper correctly caps the byte count to the remaining space, but the driver then appends buf[count] = '\0' without verifying that count is strictly less than the buffer length. When the caller supplies input at least as large as the buffer, the terminator lands one byte past the end. This is a classic CWE-787 (Out-of-Bounds Write) off-by-one; the root cause is trusting the post-truncation count as a valid index rather than a length.

RemediationAI

Patch available per vendor advisory - upgrade to a Linux kernel build that includes the IIO backend bounds-check fix, applied via the kernel.org commits 01e941aa7f5175125df4ac5d3aab099961525602, 6eea9f7648ddb9e4903735a1f77cf196c957aa38, and da9374819eb3885636934c1006d450c3cb1a02ed; distribution users should move to a vendor kernel package that incorporates these. Because the affected code is only in 6.16-rc kernels, the simplest remediation is to avoid running 6.16 release candidates in production and stay on a patched stable release. As a compensating control until patched, restrict access to the IIO backend debugfs entries by ensuring debugfs is not mounted on production hosts or is mounted with restrictive permissions (e.g., not world-writable), which removes the local write path at the cost of losing IIO backend debug/diagnostic tooling.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Linux Enterprise High Availability Extension 16.0 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server 16.1 Fixed

Share

CVE-2025-38484 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy