CVE-2025-38336 ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
A hardware bug in the pata_via driver causes system hangs during ATAPI DMA operations, requiring a kernel patch to force PIO mode.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38336?
CVE-2025-38336 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 10 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
The controller has a hardware bug that can hard hang the system when doing ATAPI DMAs without any trace of what happened. Depending on the device attached, it can also prevent the system from booting.
In this case, the system hangs when reading the ATIP from optical media with cdrecord -vvv -atip on an _NEC DVD_RW ND-4571A 1-01 and an Optiarc DVD RW AD-7200A 1.06 attached to an ASRock 990FX Extreme 4, running at UDMA/33.
The issue can be reproduced by running the same command with a cygwin build of cdrecord on WinXP, although it requires more attempts to cause it. The hang in that case is also resolved by forcing PIO. It doesn't appear that VIA has produced any drivers for that OS, thus no known workaround exists.
HDDs attached to the controller do not suffer from any DMA issues.
Which versions are affected by CVE-2025-38336?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38336?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-38336 being exploited?
There is no known exploitation of CVE-2025-38336 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-64920, BELL-CVE-2025-38336, DEBIAN-CVE-2025-38336, GHSA-9hq4-mpvh-wv3q, ROOT-OS-DEBIAN-11-CVE-2025-38336, ROOT-OS-DEBIAN-12-CVE-2025-38336 and 3 more.