CVE-2025-38197

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38197", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.993Z", "datePublished": "2025-07-04T13:37:19.926Z", "dateUpdated": "2026-10-15T21:52:11.150Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:00:19.209Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell_rbu: Fix list usage\n\nPass the correct list head to list_for_each_entry*() when looping through\nthe packet list.\n\nWithout this patch, reading the packet data via sysfs will show the data\nincorrectly (because it starts at the wrong packet), and clearing the\npacket list will result in a NULL pointer dereference."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "baseScore": 7.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is only reachable through sysfs files under /sys/devices/platform/dell_rbu/ (data, image_type, packet_size); there is no network or remote data path into dell_rbu.\nAC:L - No race, no memory-layout dependency, and no non-deterministic condition \u2014 the wrong list head is used unconditionally, so reading data at the right offset always returns uninitialized heap and clearing the packet list always dereferences NULL.\nPR:L - BIN_ATTR_RO(data, 0) yields mode 0444, so any unprivileged local user can read /sys/devices/platform/dell_rbu/data and harvest the disclosed kernel heap memory once a BIOS update has populated the packet list.\nUI:N - Once the driver is in packet mode with an image loaded \u2014 its documented operating state during a Dell BIOS update \u2014 the attacker triggers the flaw entirely on their own by reading the sysfs file, with no victim action required.\nS:U - Both the faulty traversal and its consequences are confined to the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - read_packet_data() reports more bytes than packet_read_list() actually wrote, so kernfs copies up to a full page of uninitialized kmalloc'd slab memory to an unprivileged reader, repeatably \u2014 an effectively unbounded kernel-memory read primitive.\nI:L - The traversal list_del()s and poisons the static packet_data_head, and leaves packet #1 permanently allocated, uncached, and un-zeroed \u2014 the exact stale-RBU-packet-in-memory state the code deliberately scrubs before a BIOS flash \u2014 but yields no controllable write primitive.\nA:H - packet_empty_list() executes memset(NULL, 0, packetsize), oopsing while rbu_data.lock is held, so the spinlock is never released and every subsequent access to any dell_rbu sysfs file spins forever, hanging CPUs."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/platform/x86/dell/dell_rbu.c"], "versions": [{"version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "5e8c658acd1b7c186aeffa46bf08795e121f401a", "status": "affected", "versionType": "git"}, {"version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "07d7b8e7ef7d1f812a6211ed531947c56d09e95e", "status": "affected", "versionType": "git"}, {"version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "a7b477b64ef5e37cb08dd536ae07c46f9f28262e", "status": "affected", "versionType": "git"}, {"version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "f3b840fb1508a80cd8a0efb5c886ae1995a88b24", "status": "affected", "versionType": "git"}, {"version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "4d71f2c1e5263a9f042faa71d59515709869dc79", "status": "affected", "versionType": "git"}, {"version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "32d05e6cc3a7bf6c8f16f7b7ef8fe80eca0c233e", "status": "affected", "versionType": "git"}, {"version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "61ce04601e0d8265ec6d2ffa6df5a7e1bce64854", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/platform/x86/dell/dell_rbu.c"], "versions": [{"version": "5.7", "status": "affected"}, {"version": "0", "lessThan": "5.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.239", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.186", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.142", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.95", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.35", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.4", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.10.239"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.15.186"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.1.142"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.6.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.12.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.15.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5e8c658acd1b7c186aeffa46bf08795e121f401a"}, {"url": "https://git.kernel.org/stable/c/07d7b8e7ef7d1f812a6211ed531947c56d09e95e"}, {"url": "https://git.kernel.org/stable/c/a7b477b64ef5e37cb08dd536ae07c46f9f28262e"}, {"url": "https://git.kernel.org/stable/c/f3b840fb1508a80cd8a0efb5c886ae1995a88b24"}, {"url": "https://git.kernel.org/stable/c/4d71f2c1e5263a9f042faa71d59515709869dc79"}, {"url": "https://git.kernel.org/stable/c/32d05e6cc3a7bf6c8f16f7b7ef8fe80eca0c233e"}, {"url": "https://git.kernel.org/stable/c/61ce04601e0d8265ec6d2ffa6df5a7e1bce64854"}], "title": "platform/x86: dell_rbu: Fix list usage", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:35:21.012Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38197", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:48:27.350368Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:11.150Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:35:21.012Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38197", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:48:27.350368Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:48:28.287Z"}}], "cna": {"title": "platform/x86: dell_rbu: Fix list usage", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is only reachable through sysfs files under /sys/devices/platform/dell_rbu/ (data, image_type, packet_size); there is no network or remote data path into dell_rbu.\nAC:L - No race, no memory-layout dependency, and no non-deterministic condition \u2014 the wrong list head is used unconditionally, so reading data at the right offset always returns uninitialized heap and clearing the packet list always dereferences NULL.\nPR:L - BIN_ATTR_RO(data, 0) yields mode 0444, so any unprivileged local user can read /sys/devices/platform/dell_rbu/data and harvest the disclosed kernel heap memory once a BIOS update has populated the packet list.\nUI:N - Once the driver is in packet mode with an image loaded \u2014 its documented operating state during a Dell BIOS update \u2014 the attacker triggers the flaw entirely on their own by reading the sysfs file, with no victim action required.\nS:U - Both the faulty traversal and its consequences are confined to the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - read_packet_data() reports more bytes than packet_read_list() actually wrote, so kernfs copies up to a full page of uninitialized kmalloc'd slab memory to an unprivileged reader, repeatably \u2014 an effectively unbounded kernel-memory read primitive.\nI:L - The traversal list_del()s and poisons the static packet_data_head, and leaves packet #1 permanently allocated, uncached, and un-zeroed \u2014 the exact stale-RBU-packet-in-memory state the code deliberately scrubs before a BIOS flash \u2014 but yields no controllable write primitive.\nA:H - packet_empty_list() executes memset(NULL, 0, packetsize), oopsing while rbu_data.lock is held, so the spinlock is never released and every subsequent access to any dell_rbu sysfs file spins forever, hanging CPUs."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "5e8c658acd1b7c186aeffa46bf08795e121f401a", "versionType": "git"}, {"status": "affected", "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "07d7b8e7ef7d1f812a6211ed531947c56d09e95e", "versionType": "git"}, {"status": "affected", "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "a7b477b64ef5e37cb08dd536ae07c46f9f28262e", "versionType": "git"}, {"status": "affected", "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "f3b840fb1508a80cd8a0efb5c886ae1995a88b24", "versionType": "git"}, {"status": "affected", "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "4d71f2c1e5263a9f042faa71d59515709869dc79", "versionType": "git"}, {"status": "affected", "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "32d05e6cc3a7bf6c8f16f7b7ef8fe80eca0c233e", "versionType": "git"}, {"status": "affected", "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "lessThan": "61ce04601e0d8265ec6d2ffa6df5a7e1bce64854", "versionType": "git"}], "programFiles": ["drivers/platform/x86/dell/dell_rbu.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.7"}, {"status": "unaffected", "version": "0", "lessThan": "5.7", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.239", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.186", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.142", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.95", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.35", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.4", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/platform/x86/dell/dell_rbu.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/5e8c658acd1b7c186aeffa46bf08795e121f401a"}, {"url": "https://git.kernel.org/stable/c/07d7b8e7ef7d1f812a6211ed531947c56d09e95e"}, {"url": "https://git.kernel.org/stable/c/a7b477b64ef5e37cb08dd536ae07c46f9f28262e"}, {"url": "https://git.kernel.org/stable/c/f3b840fb1508a80cd8a0efb5c886ae1995a88b24"}, {"url": "https://git.kernel.org/stable/c/4d71f2c1e5263a9f042faa71d59515709869dc79"}, {"url": "https://git.kernel.org/stable/c/32d05e6cc3a7bf6c8f16f7b7ef8fe80eca0c233e"}, {"url": "https://git.kernel.org/stable/c/61ce04601e0d8265ec6d2ffa6df5a7e1bce64854"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell_rbu: Fix list usage\n\nPass the correct list head to list_for_each_entry*() when looping through\nthe packet list.\n\nWithout this patch, reading the packet data via sysfs will show the data\nincorrectly (because it starts at the wrong packet), and clearing the\npacket list will result in a NULL pointer dereference."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.239", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.186", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.142", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.95", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.35", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.4", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16", "versionStartIncluding": "5.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:00:19.209Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38197", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:11.150Z", "dateReserved": "2025-04-16T04:51:23.993Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-07-04T13:37:19.926Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/platform/x86/dell/dell_rbu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5e8c658acd1b7c186aeffa46bf08795e121f401a", "status": "affected", "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "versionType": "git"}, {"lessThan": "07d7b8e7ef7d1f812a6211ed531947c56d09e95e", "status": "affected", "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "versionType": "git"}, {"lessThan": "a7b477b64ef5e37cb08dd536ae07c46f9f28262e", "status": "affected", "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "versionType": "git"}, {"lessThan": "f3b840fb1508a80cd8a0efb5c886ae1995a88b24", "status": "affected", "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "versionType": "git"}, {"lessThan": "4d71f2c1e5263a9f042faa71d59515709869dc79", "status": "affected", "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "versionType": "git"}, {"lessThan": "32d05e6cc3a7bf6c8f16f7b7ef8fe80eca0c233e", "status": "affected", "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "versionType": "git"}, {"lessThan": "61ce04601e0d8265ec6d2ffa6df5a7e1bce64854", "status": "affected", "version": "d19f359fbdc6b5d49e9b9a0db27a996b28a2ded3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/platform/x86/dell/dell_rbu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.7"}, {"lessThan": "5.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.239", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.186", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.142", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.95", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.35", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0770A04F-68CB-4B08-8E99-2466EB67D7A0", "versionEndExcluding": "5.10.239", "versionStartIncluding": "5.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D96F2C0D-0D4A-4658-AD34-D8A626EA422D", "versionEndExcluding": "5.15.186", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "459B4E94-FE0E-434D-B782-95E3A5FFC6B1", "versionEndExcluding": "6.1.142", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C5E01853-7048-4D78-9479-9AEE41AC8456", "versionEndExcluding": "6.6.95", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E569FD34-0076-4428-BE17-EECCF867611C", "versionEndExcluding": "6.12.35", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DFD174C5-1AA2-4671-BDDC-1A9FCC753655", "versionEndExcluding": "6.15.4", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*", "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*", "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell_rbu: Fix list usage\n\nPass the correct list head to list_for_each_entry*() when looping through\nthe packet list.\n\nWithout this patch, reading the packet data via sysfs will show the data\nincorrectly (because it starts at the wrong packet), and clearing the\npacket list will result in a NULL pointer dereference."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: platform/x86: dell_rbu: Correcci\u00f3n del uso de la lista. Pasar la cabecera de lista correcta a list_for_each_entry*() al recorrer la lista de paquetes. Sin esta correcci\u00f3n, la lectura de los datos del paquete mediante sysfs mostrar\u00e1 los datos incorrectamente (ya que comienzan en el paquete incorrecto), y al borrar la lista de paquetes se producir\u00e1 una desreferencia de puntero nulo."}], "id": "CVE-2025-38197", "lastModified": "2026-10-15T22:18:34.710", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38197", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:48:27.350368Z", "version": "2.0.3"}}]}, "published": "2025-07-04T14:15:26.913", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/07d7b8e7ef7d1f812a6211ed531947c56d09e95e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/32d05e6cc3a7bf6c8f16f7b7ef8fe80eca0c233e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4d71f2c1e5263a9f042faa71d59515709869dc79"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5e8c658acd1b7c186aeffa46bf08795e121f401a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/61ce04601e0d8265ec6d2ffa6df5a7e1bce64854"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a7b477b64ef5e37cb08dd536ae07c46f9f28262e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f3b840fb1508a80cd8a0efb5c886ae1995a88b24"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: platform/x86: dell_rbu: Fix list usage", "id": "2376393", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376393"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nplatform/x86: dell_rbu: Fix list usage\nPass the correct list head to list_for_each_entry*() when looping through\nthe packet list.\nWithout this patch, reading the packet data via sysfs will show the data\nincorrectly (because it starts at the wrong packet), and clearing the\npacket list will result in a NULL pointer dereference."], "name": "CVE-2025-38197", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38197\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38197\nhttps://lore.kernel.org/linux-cve-announce/2025070416-CVE-2025-38197-0bd2@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-13T21:47:52.321555+00:00", "updated": "2025-07-13T21:47:52.321611+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}