NetSight
IP …
high7.8

CVE-2025-38090

In the Linux kernel, the following vulnerability has been resolved: drivers/rapidio/rio_cm.c: prevent possible heap overwrite In riocm_cdev_ioctl(RIO_CM_CHAN_S…

Impact

In the Linux kernel, the following vulnerability has been resolved: drivers/rapidio/rio_cm.c: prevent possible heap overwrite In riocm_cdev_ioctl(RIO_CM_CHAN_SEND) -> cm_chan_msg_send() -> riocm_ch_send() cm_chan_msg_send() checks that userspace didn't send too much data but riocm_ch_send() failed to check that userspace sent sufficient data. The result is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr which were outside the bounds of the space which cm_chan_msg_send() allocated. Address this by teaching riocm_ch_send() to check that the entire rio_ch_chan_hdr was copied in from userspace.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.8 before 5.4.295
from 5.5 before 5.10.239
from 5.11 before 5.15.186
from 5.16 before 6.1.142
from 6.2 before 6.6.95
from 6.7 before 6.12.35
DebianDebian Linux
Version 11.0

References