{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2025-38090",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2025-38090"
  ],
  "published": "2025-06-30T07:30:10Z",
  "summary": "drivers/rapidio/rio_cm.c: prevent possible heap overwrite",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers/rapidio/rio_cm.c: prevent possible heap overwrite\n\nIn\n\nriocm_cdev_ioctl(RIO_CM_CHAN_SEND)\n   -> cm_chan_msg_send()\n      -> riocm_ch_send()\n\ncm_chan_msg_send() checks that userspace didn't send too much data but\nriocm_ch_send() failed to check that userspace sent sufficient data.  The\nresult is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr\nwhich were outside the bounds of the space which cm_chan_msg_send()\nallocated.\n\nAddress this by teaching riocm_ch_send() to check that the entire\nrio_ch_chan_hdr was copied in from userspace.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.142",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38090"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a8b5ea2e302aa5cd00fc7addd8df53c9bde7b5f6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/c03ddc183249f03fc7e057e02cae6f89144d0123"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/58f664614f8c3d6142ab81ae551e466dc6e092e8"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ecf5ee280b702270afb02f61b299d3dfe3ec7730"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1921781ec4a8824bd0c520bf9363e28a880d14ec"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1cce6ac47f4a2ac1766b8a188dc8c8f6d8df2a53"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6d5c6711a55c35ce09b90705546050408d9d4b61"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/50695153d7ddde3b1696dbf0085be0033bf3ddb3"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T12:19:11Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The overflow is triggered through the `RIO_CM_CHAN_SEND` ioctl on the `/dev/rio_cm` character device, requiring local access to the system; no remote peer input is needed to reach the vulnerable write.\nAC:L - The attacker directly chooses `msg.size` (any value 1-19) to control both the slab cache and the overflow offset, the write is unconditional and deterministic with no race involved, and a connected channel is reachable either by the attacker's own connect/accept or by using another process's channel via the unchecked global channel idr.\nPR:L - The rio_cm driver performs no `capable()`/`CAP_*` checks anywhere in its open or ioctl paths, so any unprivileged local user able to open `/dev/rio_cm` can issue the malicious send, and the send path does not even verify that the target channel belongs to the caller's file descriptor.\nUI:N - Exploitation requires only the attacker's own ioctl sequence (create/connect or reuse an existing channel, then send); no action by any other user is needed.\nS:U - The heap corruption occurs in kernel slab memory within the same security authority; there is no crossing of a VM, IOMMU, or other trust boundary.\nC:H - The controlled out-of-bounds write into general-purpose `kmalloc-8`/`kmalloc-16` objects can corrupt adjacent structures (length/size fields, pointers, freelist metadata), which is leverageable into arbitrary kernel memory disclosure.\nI:H - This is a heap out-of-bounds write of up to 17 bytes with attacker-selected target cache and partially attacker-controlled content, a classic primitive for corrupting adjacent kernel objects and escalating to arbitrary write/code execution.\nA:H - Overwriting adjacent slab objects and SLUB freelist data reliably produces kernel oops/panic or list corruption, and the ioctl can be repeated at will to crash the system."
    }
  }
}