CVE-2025-38090 drivers/rapidio/rio_cm.c: prevent possible heap overwrite
A heap overwrite vulnerability in the Linux kernel RapidIO driver allows local attackers to potentially execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38090?
CVE-2025-38090 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 30 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
In
riocm_cdev_ioctl(RIO_CM_CHAN_SEND) -> cm_chan_msg_send() -> riocm_ch_send()
cm_chan_msg_send() checks that userspace didn't send too much data but riocm_ch_send() failed to check that userspace sent sufficient data. The result is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr which were outside the bounds of the space which cm_chan_msg_send() allocated.
Address this by teaching riocm_ch_send() to check that the entire rio_ch_chan_hdr was copied in from userspace.
Which versions are affected by CVE-2025-38090?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38090?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-38090 being exploited?
There is no known exploitation of CVE-2025-38090 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-64401, BELL-CVE-2025-38090, DEBIAN-CVE-2025-38090, GHSA-vjwf-vf62-c8wp, ROOT-OS-DEBIAN-11-CVE-2025-38090, ROOT-OS-DEBIAN-12-CVE-2025-38090 and 3 more.