{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2025-38239",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2025-38239"
  ],
  "published": "2025-07-09T10:43:51Z",
  "summary": "scsi: megaraid_sas: Fix invalid node index",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: megaraid_sas: Fix invalid node index\n\nOn a system with DRAM interleave enabled, out-of-bound access is\ndetected:\n\nmegaraid_sas 0000:3f:00.0: requested/available msix 128/128 poll_queue 0\n------------[ cut here ]------------\nUBSAN: array-index-out-of-bounds in ./arch/x86/include/asm/topology.h:72:28\nindex -1 is out of range for type 'cpumask *[1024]'\ndump_stack_lvl+0x5d/0x80\nubsan_epilogue+0x5/0x2b\n__ubsan_handle_out_of_bounds.cold+0x46/0x4b\nmegasas_alloc_irq_vectors+0x149/0x190 [megaraid_sas]\nmegasas_probe_one.cold+0xa4d/0x189c [megaraid_sas]\nlocal_pci_probe+0x42/0x90\npci_device_probe+0xdc/0x290\nreally_probe+0xdb/0x340\n__driver_probe_device+0x78/0x110\ndriver_probe_device+0x1f/0xa0\n__driver_attach+0xba/0x1c0\nbus_for_each_dev+0x8b/0xe0\nbus_add_driver+0x142/0x220\ndriver_register+0x72/0xd0\nmegasas_init+0xdf/0xff0 [megaraid_sas]\ndo_one_initcall+0x57/0x310\ndo_init_module+0x90/0x250\ninit_module_from_file+0x85/0xc0\nidempotent_init_module+0x114/0x310\n__x64_sys_finit_module+0x65/0xc0\ndo_syscall_64+0x82/0x170\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFix it accordingly.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.143",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38239"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f1064b3532192e987ab17be7281d5fee36fd25e1"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/bf2c1643abc3b2507d56bb6c22bf9897272f8a35"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/19a47c966deb36624843b7301f0373a3dc541a05"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/074efb35552556a4b3b25eedab076d5dc24a8199"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/752eb816b55adb0673727ba0ed96609a17895654"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T12:19:11Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.3,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The bug is in the megaraid_sas PCI probe path and its consequence is consumed via a local procfs read (`/proc/irq/<N>/affinity_hint`); there is no network-reachable component. Local access to the machine is required.\nAC:L - On a system in the affected configuration the out-of-bounds `node_to_cpumask_map[-1]` read occurs deterministically on every probe, and the follow-on procfs read that dereferences the poisoned pointer is a plain file read the attacker can repeat at will with no race or timing dependency.\nPR:L - The corrupted `irq_desc::affinity_hint` is installed by the system itself during ordinary boot without any attacker action; dereferencing it only requires reading world-readable (0444) `/proc/irq/<N>/affinity_hint`, which any unprivileged local account can do.\nUI:N - The vulnerable state is established automatically at driver probe, and the attacker triggers the dereference himself via a procfs read \u2014 no victim action of any kind is needed.\nS:U - The out-of-bounds read, the wild dereference, and its effects are all confined to the kernel's own security authority with no crossing into a hypervisor, IOMMU, or other domain.\nC:H - An uncontrolled value adjacent to `node_to_cpumask_map` is treated as a `struct cpumask *`, and `cpumask_copy()` reads `nr_cpu_ids` bits from that arbitrary kernel address straight into a bitmap printed to unprivileged userspace \u2014 kernel memory disclosure, not a strictly bounded few-byte read.\nI:L - No out-of-bounds write or control-flow hijack primitive exists; the only modification is that MSI-X affinity for the eight high-IOPS storage vectors gets programmed from an uncontrolled mask, misconfiguring interrupt routing on the system's RAID controller.\nA:H - Dereferencing an arbitrary, potentially unmapped value as a cpumask inside `raw_spinlock_irq` with interrupts disabled can oops or panic the kernel, and the storage controller's interrupt affinity can be left broken."
    }
  }
}