CVE-2025-38412

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38412", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.013Z", "datePublished": "2025-07-25T13:20:16.688Z", "dateUpdated": "2026-10-15T21:52:15.661Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:41.721Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks\n\nAfter retrieving WMI data blocks in sysfs callbacks, check for the\nvalidity of them before dereferencing their content."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through a sysfs file read on the local machine (`/sys/class/firmware-attributes/dell-wmi-sysman/...`), which requires local access to the system. There is no network, adjacent-network, or physical-only path to `is_enabled_show()`/`current_value_show()`.\nAC:L - On an affected Dell/Alienware system whose firmware returns a non-package or short WMI data block, a single `cat` of the sysfs file deterministically and repeatably hits the unvalidated dereference \u2014 no race to win, no memory-layout grooming, and no state the attacker must wait for. The attack can be repeated arbitrarily to re-trigger the fault or harvest additional leaked bytes.\nPR:L - `passobj-attributes.c` exposes `is_enabled` via `__ATTR_RO()`, i.e. mode 0444, so any unprivileged local user can read it and drive `is_enabled_show()` into the unchecked `obj->package.elements[IS_PASS_SET]` dereference; only a basic user account is needed, not root.\nUI:N - The attacker performs the triggering read themselves via an ordinary open()/read() on the world-readable sysfs attribute. No victim action, no privileged helper, and no administrator interaction is required.\nS:U - The out-of-bounds read, wild-pointer dereference, and any resulting crash all occur inside the kernel of the same system, managed by the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The type confusion turns a firmware-supplied 64-bit value (or a string/buffer data pointer) into the `elements` array base, yielding an out-of-bounds \u2014 effectively arbitrary-address \u2014 kernel read whose result is then formatted with `snprintf(\"%s\"/\"%lld\")` straight into the sysfs buffer returned to userspace. Because the vulnerable `is_enabled` attribute is world-readable, an unprivileged user obtains a repeatable kernel memory disclosure primitive.\nI:H - This is a genuine type confusion \u2014 a `union acpi_object` of type Integer/String/Buffer is interpreted as a Package, so an attacker-influencable firmware value is consumed as a kernel pointer and indexed. Per the type-confusion classification, and given that a firmware-controlled pointer dereference in a driver that also performs BIOS attribute and password-object operations undermines the integrity of the kernel's view of that data, this is scored High.\nA:H - Dereferencing the confused `elements` pointer (an arbitrary firmware integer, or an out-of-bounds address past a buffer/short package) reliably produces an unhandled page fault and kernel oops/panic, and the subsequent `%s` dereference of an out-of-bounds `string.pointer` compounds this. Any local user can trigger it on demand by reading the 0444 `is_enabled` file, making it a repeatable full denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h", "drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/int-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/string-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/sysman.c"], "versions": [{"version": "e8a60aa7404bfef37705da5607c97737073ac38d", "lessThan": "92c2d914b5337431d885597a79a3a3d9d55e80b7", "status": "affected", "versionType": "git"}, {"version": "e8a60aa7404bfef37705da5607c97737073ac38d", "lessThan": "68e9963583d11963ceca5d276e9c44684509f759", "status": "affected", "versionType": "git"}, {"version": "e8a60aa7404bfef37705da5607c97737073ac38d", "lessThan": "0deb3eb78ebf225cb41aa9b2b2150f46cbfd359e", "status": "affected", "versionType": "git"}, {"version": "e8a60aa7404bfef37705da5607c97737073ac38d", "lessThan": "5df3b870bc389a1767c72448a3ce1c576ef4deab", "status": "affected", "versionType": "git"}, {"version": "e8a60aa7404bfef37705da5607c97737073ac38d", "lessThan": "aaf847dcb4114fe8b25d4c1c790bedcb6088cb3d", "status": "affected", "versionType": "git"}, {"version": "e8a60aa7404bfef37705da5607c97737073ac38d", "lessThan": "eb617dd25ca176f3fee24f873f0fd60010773d67", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h", "drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/int-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/string-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/sysman.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.187", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.144", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.97", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.37", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.6", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.187"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.144"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.37"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.15.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/92c2d914b5337431d885597a79a3a3d9d55e80b7"}, {"url": "https://git.kernel.org/stable/c/68e9963583d11963ceca5d276e9c44684509f759"}, {"url": "https://git.kernel.org/stable/c/0deb3eb78ebf225cb41aa9b2b2150f46cbfd359e"}, {"url": "https://git.kernel.org/stable/c/5df3b870bc389a1767c72448a3ce1c576ef4deab"}, {"url": "https://git.kernel.org/stable/c/aaf847dcb4114fe8b25d4c1c790bedcb6088cb3d"}, {"url": "https://git.kernel.org/stable/c/eb617dd25ca176f3fee24f873f0fd60010773d67"}], "title": "platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:37:44.050Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38412", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:50:12.754501Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:15.661Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:37:44.050Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38412", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:50:12.754501Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:50:13.674Z"}}], "cna": {"title": "platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through a sysfs file read on the local machine (`/sys/class/firmware-attributes/dell-wmi-sysman/...`), which requires local access to the system. There is no network, adjacent-network, or physical-only path to `is_enabled_show()`/`current_value_show()`.\nAC:L - On an affected Dell/Alienware system whose firmware returns a non-package or short WMI data block, a single `cat` of the sysfs file deterministically and repeatably hits the unvalidated dereference \u2014 no race to win, no memory-layout grooming, and no state the attacker must wait for. The attack can be repeated arbitrarily to re-trigger the fault or harvest additional leaked bytes.\nPR:L - `passobj-attributes.c` exposes `is_enabled` via `__ATTR_RO()`, i.e. mode 0444, so any unprivileged local user can read it and drive `is_enabled_show()` into the unchecked `obj->package.elements[IS_PASS_SET]` dereference; only a basic user account is needed, not root.\nUI:N - The attacker performs the triggering read themselves via an ordinary open()/read() on the world-readable sysfs attribute. No victim action, no privileged helper, and no administrator interaction is required.\nS:U - The out-of-bounds read, wild-pointer dereference, and any resulting crash all occur inside the kernel of the same system, managed by the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The type confusion turns a firmware-supplied 64-bit value (or a string/buffer data pointer) into the `elements` array base, yielding an out-of-bounds \u2014 effectively arbitrary-address \u2014 kernel read whose result is then formatted with `snprintf(\"%s\"/\"%lld\")` straight into the sysfs buffer returned to userspace. Because the vulnerable `is_enabled` attribute is world-readable, an unprivileged user obtains a repeatable kernel memory disclosure primitive.\nI:H - This is a genuine type confusion \u2014 a `union acpi_object` of type Integer/String/Buffer is interpreted as a Package, so an attacker-influencable firmware value is consumed as a kernel pointer and indexed. Per the type-confusion classification, and given that a firmware-controlled pointer dereference in a driver that also performs BIOS attribute and password-object operations undermines the integrity of the kernel's view of that data, this is scored High.\nA:H - Dereferencing the confused `elements` pointer (an arbitrary firmware integer, or an out-of-bounds address past a buffer/short package) reliably produces an unhandled page fault and kernel oops/panic, and the subsequent `%s` dereference of an out-of-bounds `string.pointer` compounds this. Any local user can trigger it on demand by reading the 0444 `is_enabled` file, making it a repeatable full denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e8a60aa7404bfef37705da5607c97737073ac38d", "lessThan": "92c2d914b5337431d885597a79a3a3d9d55e80b7", "versionType": "git"}, {"status": "affected", "version": "e8a60aa7404bfef37705da5607c97737073ac38d", "lessThan": "68e9963583d11963ceca5d276e9c44684509f759", "versionType": "git"}, {"status": "affected", "version": "e8a60aa7404bfef37705da5607c97737073ac38d", "lessThan": "0deb3eb78ebf225cb41aa9b2b2150f46cbfd359e", "versionType": "git"}, {"status": "affected", "version": "e8a60aa7404bfef37705da5607c97737073ac38d", "lessThan": "5df3b870bc389a1767c72448a3ce1c576ef4deab", "versionType": "git"}, {"status": "affected", "version": "e8a60aa7404bfef37705da5607c97737073ac38d", "lessThan": "aaf847dcb4114fe8b25d4c1c790bedcb6088cb3d", "versionType": "git"}, {"status": "affected", "version": "e8a60aa7404bfef37705da5607c97737073ac38d", "lessThan": "eb617dd25ca176f3fee24f873f0fd60010773d67", "versionType": "git"}], "programFiles": ["drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h", "drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/int-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/string-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/sysman.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"status": "unaffected", "version": "0", "lessThan": "5.11", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.187", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.144", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.97", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.37", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.6", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h", "drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/int-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/string-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/sysman.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/92c2d914b5337431d885597a79a3a3d9d55e80b7"}, {"url": "https://git.kernel.org/stable/c/68e9963583d11963ceca5d276e9c44684509f759"}, {"url": "https://git.kernel.org/stable/c/0deb3eb78ebf225cb41aa9b2b2150f46cbfd359e"}, {"url": "https://git.kernel.org/stable/c/5df3b870bc389a1767c72448a3ce1c576ef4deab"}, {"url": "https://git.kernel.org/stable/c/aaf847dcb4114fe8b25d4c1c790bedcb6088cb3d"}, {"url": "https://git.kernel.org/stable/c/eb617dd25ca176f3fee24f873f0fd60010773d67"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks\n\nAfter retrieving WMI data blocks in sysfs callbacks, check for the\nvalidity of them before dereferencing their content."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.187", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.144", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.97", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.37", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.6", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16", "versionStartIncluding": "5.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:41.721Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38412", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:15.661Z", "dateReserved": "2025-04-16T04:51:24.013Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-07-25T13:20:16.688Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h", "drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/int-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/string-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/sysman.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "92c2d914b5337431d885597a79a3a3d9d55e80b7", "status": "affected", "version": "e8a60aa7404bfef37705da5607c97737073ac38d", "versionType": "git"}, {"lessThan": "68e9963583d11963ceca5d276e9c44684509f759", "status": "affected", "version": "e8a60aa7404bfef37705da5607c97737073ac38d", "versionType": "git"}, {"lessThan": "0deb3eb78ebf225cb41aa9b2b2150f46cbfd359e", "status": "affected", "version": "e8a60aa7404bfef37705da5607c97737073ac38d", "versionType": "git"}, {"lessThan": "5df3b870bc389a1767c72448a3ce1c576ef4deab", "status": "affected", "version": "e8a60aa7404bfef37705da5607c97737073ac38d", "versionType": "git"}, {"lessThan": "aaf847dcb4114fe8b25d4c1c790bedcb6088cb3d", "status": "affected", "version": "e8a60aa7404bfef37705da5607c97737073ac38d", "versionType": "git"}, {"lessThan": "eb617dd25ca176f3fee24f873f0fd60010773d67", "status": "affected", "version": "e8a60aa7404bfef37705da5607c97737073ac38d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h", "drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/int-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/string-attributes.c", "drivers/platform/x86/dell/dell-wmi-sysman/sysman.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.187", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.144", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.97", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.37", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4BD28D29-423C-4173-9DB8-3BA14E9F665D", "versionEndExcluding": "5.15.187", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "81CF08DB-B7A2-4556-8AE3-ED9144F50E31", "versionEndExcluding": "6.1.144", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EB1BB991-B903-4718-966C-07C803CBEABC", "versionEndExcluding": "6.6.97", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B4159AA-C70D-4DE5-9EE2-8F2728F13C5D", "versionEndExcluding": "6.12.37", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6E0BB4E0-44BC-4645-83A8-6EA232CE624C", "versionEndExcluding": "6.15.6", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*", "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*", "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*", "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*", "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks\n\nAfter retrieving WMI data blocks in sysfs callbacks, check for the\nvalidity of them before dereferencing their content."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: plataforma/x86: dell-wmi-sysman: reparar la recuperaci\u00f3n de bloques de datos WMI en devoluciones de llamadas sysfs Despu\u00e9s de recuperar bloques de datos WMI en devoluciones de llamadas sysfs, verifique su validez antes de desreferenciar su contenido."}], "id": "CVE-2025-38412", "lastModified": "2026-10-15T22:18:40.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38412", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:50:12.754501Z", "version": "2.0.3"}}]}, "published": "2025-07-25T14:15:32.903", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0deb3eb78ebf225cb41aa9b2b2150f46cbfd359e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5df3b870bc389a1767c72448a3ce1c576ef4deab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/68e9963583d11963ceca5d276e9c44684509f759"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/92c2d914b5337431d885597a79a3a3d9d55e80b7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aaf847dcb4114fe8b25d4c1c790bedcb6088cb3d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/eb617dd25ca176f3fee24f873f0fd60010773d67"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks", "id": "2383398", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383398"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nplatform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks\nAfter retrieving WMI data blocks in sysfs callbacks, check for the\nvalidity of them before dereferencing their content."], "name": "CVE-2025-38412", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38412\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38412\nhttps://lore.kernel.org/linux-cve-announce/2025072521-CVE-2025-38412-2ccc@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-26T11:22:10.868591+00:00", "updated": "2025-07-26T11:22:10.868670+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}