CVE-2025-38197 (GCVE-0-2025-38197)
Vulnerability from cvelistv5
Published
2025-07-04 13:37
Modified
2026-08-05 12:00
Severity ?
7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell_rbu: Fix list usage Pass the correct list head to list_for_each_entry*() when looping through the packet list. Without this patch, reading the packet data via sysfs will show the data incorrectly (because it starts at the wrong packet), and clearing the packet list will result in a NULL pointer dereference.
References
Impacted products
Vendor Product Version
Linux Linux Version: d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3
Version: d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3
Version: d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3
Version: d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3
Version: d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3
Version: d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3
Version: d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:35:21.012Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/dell/dell_rbu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5e8c658acd1b7c186aeffa46bf08795e121f401a",
              "status": "affected",
              "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3",
              "versionType": "git"
            },
            {
              "lessThan": "07d7b8e7ef7d1f812a6211ed531947c56d09e95e",
              "status": "affected",
              "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3",
              "versionType": "git"
            },
            {
              "lessThan": "a7b477b64ef5e37cb08dd536ae07c46f9f28262e",
              "status": "affected",
              "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3",
              "versionType": "git"
            },
            {
              "lessThan": "f3b840fb1508a80cd8a0efb5c886ae1995a88b24",
              "status": "affected",
              "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3",
              "versionType": "git"
            },
            {
              "lessThan": "4d71f2c1e5263a9f042faa71d59515709869dc79",
              "status": "affected",
              "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3",
              "versionType": "git"
            },
            {
              "lessThan": "32d05e6cc3a7bf6c8f16f7b7ef8fe80eca0c233e",
              "status": "affected",
              "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3",
              "versionType": "git"
            },
            {
              "lessThan": "61ce04601e0d8265ec6d2ffa6df5a7e1bce64854",
              "status": "affected",
              "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/dell/dell_rbu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell_rbu: Fix list usage\n\nPass the correct list head to list_for_each_entry*() when looping through\nthe packet list.\n\nWithout this patch, reading the packet data via sysfs will show the data\nincorrectly (because it starts at the wrong packet), and clearing the\npacket list will result in a NULL pointer dereference."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is only reachable through sysfs files under /sys/devices/platform/dell_rbu/ (data, image_type, packet_size); there is no network or remote data path into dell_rbu.\nAC:L - No race, no memory-layout dependency, and no non-deterministic condition \u2014 the wrong list head is used unconditionally, so reading data at the right offset always returns uninitialized heap and clearing the packet list always dereferences NULL.\nPR:L - BIN_ATTR_RO(data, 0) yields mode 0444, so any unprivileged local user can read /sys/devices/platform/dell_rbu/data and harvest the disclosed kernel heap memory once a BIOS update has populated the packet list.\nUI:N - Once the driver is in packet mode with an image loaded \u2014 its documented operating state during a Dell BIOS update \u2014 the attacker triggers the flaw entirely on their own by reading the sysfs file, with no victim action required.\nS:U - Both the faulty traversal and its consequences are confined to the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - read_packet_data() reports more bytes than packet_read_list() actually wrote, so kernfs copies up to a full page of uninitialized kmalloc\u0027d slab memory to an unprivileged reader, repeatably \u2014 an effectively unbounded kernel-memory read primitive.\nI:L - The traversal list_del()s and poisons the static packet_data_head, and leaves packet #1 permanently allocated, uncached, and un-zeroed \u2014 the exact stale-RBU-packet-in-memory state the code deliberately scrubs before a BIOS flash \u2014 but yields no controllable write primitive.\nA:H - packet_empty_list() executes memset(NULL, 0, packetsize), oopsing while rbu_data.lock is held, so the spinlock is never released and every subsequent access to any dell_rbu sysfs file spins forever, hanging CPUs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:19.209Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5e8c658acd1b7c186aeffa46bf08795e121f401a"
        },
        {
          "url": "https://git.kernel.org/stable/c/07d7b8e7ef7d1f812a6211ed531947c56d09e95e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7b477b64ef5e37cb08dd536ae07c46f9f28262e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3b840fb1508a80cd8a0efb5c886ae1995a88b24"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d71f2c1e5263a9f042faa71d59515709869dc79"
        },
        {
          "url": "https://git.kernel.org/stable/c/32d05e6cc3a7bf6c8f16f7b7ef8fe80eca0c233e"
        },
        {
          "url": "https://git.kernel.org/stable/c/61ce04601e0d8265ec6d2ffa6df5a7e1bce64854"
        }
      ],
      "title": "platform/x86: dell_rbu: Fix list usage",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38197",
    "datePublished": "2025-07-04T13:37:19.926Z",
    "dateReserved": "2025-04-16T04:51:23.993Z",
    "dateUpdated": "2026-08-05T12:00:19.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.