CVE-2025-38408 (GCVE-0-2025-38408)
Vulnerability from cvelistv5
Published
2025-07-25 13:20
Modified
2026-08-05 12:01
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: genirq/irq_sim: Initialize work context pointers properly Initialize `ops` member's pointers properly by using kzalloc() instead of kmalloc() when allocating the simulation work context. Otherwise the pointers contain random content leading to invalid dereferencing.
References
Impacted products
Vendor Product Version
Linux Linux Version: 337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1
Version: 337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1
Version: 337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1
Version: 337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1
Version: 337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1
Version: 337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/irq/irq_sim.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "186df821de0f34490ed5fc0861243748b2483861",
              "status": "affected",
              "version": "337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1",
              "versionType": "git"
            },
            {
              "lessThan": "c71aa4bb528ae6f8fd7577a0a39e5a03c60b04fb",
              "status": "affected",
              "version": "337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1",
              "versionType": "git"
            },
            {
              "lessThan": "ec3656a8cb428d763def32bc2fa695f94be23629",
              "status": "affected",
              "version": "337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1",
              "versionType": "git"
            },
            {
              "lessThan": "19bd7597858dd15802c1d99fcc38e528f469080a",
              "status": "affected",
              "version": "337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1",
              "versionType": "git"
            },
            {
              "lessThan": "7f73d1def72532bac4d55ea8838f457a6bed955c",
              "status": "affected",
              "version": "337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1",
              "versionType": "git"
            },
            {
              "lessThan": "8a2277a3c9e4cc5398f80821afe7ecbe9bdf2819",
              "status": "affected",
              "version": "337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/irq/irq_sim.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngenirq/irq_sim: Initialize work context pointers properly\n\nInitialize `ops` member\u0027s pointers properly by using kzalloc() instead of\nkmalloc() when allocating the simulation work context. Otherwise the\npointers contain random content leading to invalid dereferencing."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through a local ioctl on the GPIO character device (/dev/gpiochipN) exposed by the gpio-mockup simulator, or via the local iio-dummy device; there is no network-facing path to irq_sim.\nAC:L - A single GPIO_V2_GET_LINE_IOCTL with an edge-detect flag deterministically drives request_threaded_irq() into irq_sim_request_resources(), which unconditionally tests and calls the uninitialized ops pointer on every request; the attacker can additionally groom the kmalloc-96 slab to shape the stale contents.\nPR:L - An unprivileged local account with access to the GPIO chardev \u2014 routinely granted via the \"gpio\" group udev rule on embedded, IoT and automation systems \u2014 can request an edge-triggered line and reach the wild call; no root or capability is required for the triggering ioctl.\nUI:N - The attacker triggers the faulty indirect call entirely through their own ioctl/close sequence; no action by another user or administrator is needed.\nS:U - The uninitialized function-pointer call executes in kernel context on the same host and does not cross a virtualization, IOMMU, or sandbox authority boundary.\nC:H - Branching to an attacker-groomable stale heap value is a direct control-flow hijack primitive that can be leveraged into arbitrary kernel memory disclosure; the call also leaks the state of recycled slab memory into control flow.\nI:H - Calling through an uninitialized function pointer whose backing slab object can be sprayed with attacker-controlled data yields instruction-pointer control and hence arbitrary kernel code execution and memory modification.\nA:H - Even without successful grooming, the indirect branch to stale garbage causes an immediate kernel oops or CFI panic, and it can be triggered repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:39.572Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/186df821de0f34490ed5fc0861243748b2483861"
        },
        {
          "url": "https://git.kernel.org/stable/c/c71aa4bb528ae6f8fd7577a0a39e5a03c60b04fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec3656a8cb428d763def32bc2fa695f94be23629"
        },
        {
          "url": "https://git.kernel.org/stable/c/19bd7597858dd15802c1d99fcc38e528f469080a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f73d1def72532bac4d55ea8838f457a6bed955c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a2277a3c9e4cc5398f80821afe7ecbe9bdf2819"
        }
      ],
      "title": "genirq/irq_sim: Initialize work context pointers properly",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38408",
    "datePublished": "2025-07-25T13:20:13.253Z",
    "dateReserved": "2025-04-16T04:51:24.013Z",
    "dateUpdated": "2026-08-05T12:01:39.572Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.