CVE-2025-38003

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38003
In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu read protection for procfs content When the procfs content is generated for a bcm_op which is in the process to be removed the procfs output might show unreliable data (UAF). As the removal of bcm_op's is already implemented with rcu handling this patch adds the missing rcu_read_lock() and makes sure the list entries are properly removed under rcu protection.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0622846db728a5332b917c797c733e202c4620ae Patch
https://git.kernel.org/stable/c/19f553a1ddf260da6570ed8f8d91a8c87f49b63a Patch
https://git.kernel.org/stable/c/1f912f8484e9c4396378c39460bbea0af681f319 Patch
https://git.kernel.org/stable/c/63567ecd99a24495208dc860d50fb17440043006 Patch
https://git.kernel.org/stable/c/659701c0b954ccdb4a916a4ad59bbc16e726d42c Patch
https://git.kernel.org/stable/c/6d7d458c41b98a5c1670cbd36f2923c37de51cf5 Patch
https://git.kernel.org/stable/c/7c9db92d5f0eadca30884af75c53d601edc512ee Patch
https://git.kernel.org/stable/c/dac5e6249159ac255dad9781793dbe5908ac9ddb Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc8:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

17 Dec 2025, 20:04

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc8:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc6:*:*:*:*:*:*
CWE NVD-CWE-noinfo
References () https://git.kernel.org/stable/c/0622846db728a5332b917c797c733e202c4620ae - () https://git.kernel.org/stable/c/0622846db728a5332b917c797c733e202c4620ae - Patch
References () https://git.kernel.org/stable/c/19f553a1ddf260da6570ed8f8d91a8c87f49b63a - () https://git.kernel.org/stable/c/19f553a1ddf260da6570ed8f8d91a8c87f49b63a - Patch
References () https://git.kernel.org/stable/c/1f912f8484e9c4396378c39460bbea0af681f319 - () https://git.kernel.org/stable/c/1f912f8484e9c4396378c39460bbea0af681f319 - Patch
References () https://git.kernel.org/stable/c/63567ecd99a24495208dc860d50fb17440043006 - () https://git.kernel.org/stable/c/63567ecd99a24495208dc860d50fb17440043006 - Patch
References () https://git.kernel.org/stable/c/659701c0b954ccdb4a916a4ad59bbc16e726d42c - () https://git.kernel.org/stable/c/659701c0b954ccdb4a916a4ad59bbc16e726d42c - Patch
References () https://git.kernel.org/stable/c/6d7d458c41b98a5c1670cbd36f2923c37de51cf5 - () https://git.kernel.org/stable/c/6d7d458c41b98a5c1670cbd36f2923c37de51cf5 - Patch
References () https://git.kernel.org/stable/c/7c9db92d5f0eadca30884af75c53d601edc512ee - () https://git.kernel.org/stable/c/7c9db92d5f0eadca30884af75c53d601edc512ee - Patch
References () https://git.kernel.org/stable/c/dac5e6249159ac255dad9781793dbe5908ac9ddb - () https://git.kernel.org/stable/c/dac5e6249159ac255dad9781793dbe5908ac9ddb - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel

03 Nov 2025, 18:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: bcm: añadir protección de lectura rcu faltante para el contenido de procfs. Cuando se genera el contenido de procfs para un bcm_op que se va a eliminar, la salida de procfs podría mostrar datos no fiables (UAF). Dado que la eliminación de bcm_op ya está implementada con la gestión de rcu, este parche añade el rcu_read_lock() faltante y garantiza que las entradas de la lista se eliminen correctamente bajo la protección de rcu.
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

08 Jun 2025, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-08 11:15

Updated : 2025-12-17 20:04

NVD link : CVE-2025-38003

Mitre link : CVE-2025-38003

CVE.ORG link : CVE-2025-38003

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
NVD-CWE-noinfo