CVE-2025-38548

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38548
In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Validate the size of the received input buffer Add buffer_recv_size to store the size of the received bytes. Validate buffer_recv_size in send_usb_cmd().

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0db770e2922389753ddbd6663a5516a32b97b743 Patch
https://git.kernel.org/stable/c/2771d2ee3d95700f34e1e4df6a445c90565cd4e9 Patch
https://git.kernel.org/stable/c/2e6f4d9cfbda52700c126c5a2b93dd2042e8680c Patch
https://git.kernel.org/stable/c/3c4bdc8a852e446080adc8ceb90ddd67a56e1bb8 Patch
https://git.kernel.org/stable/c/495a4f0dce9c8c4478c242209748f1ee9e4d5820 Patch
https://git.kernel.org/stable/c/4eb5cc48399f89b63acdbfe912fa5c8fe2900147 Patch
https://git.kernel.org/stable/c/eda5e38cc4dd2dcb422840540374910ef2818494 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory Mailing List
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

07 Jan 2026, 18:33

Type Values Removed Values Added
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CWE NVD-CWE-noinfo
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
References () https://git.kernel.org/stable/c/0db770e2922389753ddbd6663a5516a32b97b743 - () https://git.kernel.org/stable/c/0db770e2922389753ddbd6663a5516a32b97b743 - Patch
References () https://git.kernel.org/stable/c/2771d2ee3d95700f34e1e4df6a445c90565cd4e9 - () https://git.kernel.org/stable/c/2771d2ee3d95700f34e1e4df6a445c90565cd4e9 - Patch
References () https://git.kernel.org/stable/c/2e6f4d9cfbda52700c126c5a2b93dd2042e8680c - () https://git.kernel.org/stable/c/2e6f4d9cfbda52700c126c5a2b93dd2042e8680c - Patch
References () https://git.kernel.org/stable/c/3c4bdc8a852e446080adc8ceb90ddd67a56e1bb8 - () https://git.kernel.org/stable/c/3c4bdc8a852e446080adc8ceb90ddd67a56e1bb8 - Patch
References () https://git.kernel.org/stable/c/495a4f0dce9c8c4478c242209748f1ee9e4d5820 - () https://git.kernel.org/stable/c/495a4f0dce9c8c4478c242209748f1ee9e4d5820 - Patch
References () https://git.kernel.org/stable/c/4eb5cc48399f89b63acdbfe912fa5c8fe2900147 - () https://git.kernel.org/stable/c/4eb5cc48399f89b63acdbfe912fa5c8fe2900147 - Patch
References () https://git.kernel.org/stable/c/eda5e38cc4dd2dcb422840540374910ef2818494 - () https://git.kernel.org/stable/c/eda5e38cc4dd2dcb422840540374910ef2818494 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory, Mailing List
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory, Mailing List
CPE cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*

03 Nov 2025, 18:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

28 Aug 2025, 15:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/2e6f4d9cfbda52700c126c5a2b93dd2042e8680c -
  • () https://git.kernel.org/stable/c/4eb5cc48399f89b63acdbfe912fa5c8fe2900147 -

18 Aug 2025, 20:16

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: hwmon: (corsair-cpro) Validar el tamaño del búfer de entrada recibido. Añadir buffer_recv_size para almacenar el tamaño de los bytes recibidos. Validar buffer_recv_size en send_usb_cmd().

16 Aug 2025, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-16 12:15

Updated : 2026-01-07 18:33

NVD link : CVE-2025-38548

Mitre link : CVE-2025-38548

CVE.ORG link : CVE-2025-38548

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
NVD-CWE-noinfo