Critical Vulnerability in Linux Kernel: Memory Handling Flaw in BIOS Version Logging
Summary
CVE-2025-38332: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow alt... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its robustness and flexibility, supporting a wide range of devices and architectures. However, like any complex software, it is susceptible to vulnerabilities that can compromise system integrity and security. This particular vulnerability affects the BIOS version logging mechanism within the SCSI lpfc driver, which is critical for Fibre Channel communications.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SCSI lpfc driver related to the handling of BIOS version strings. The issue arises from the use of strlcat() with FORTIFY support, which incorrectly triggers a panic due to perceived buffer overflow risks, despite the correct buffer size being provided. This flaw could lead to system crashes or unexpected behavior, particularly in environments relying on the lpfc driver for storage operations. The vulnerability is classified under CVE-2025-38332 and affects multiple Debian versions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functionality until the package is updated. However, it is strongly recommended to apply the patch as soon as it is available to ensure system stability and security.
Conclusion
The vulnerability CVE-2025-38332 in the Linux kernel's SCSI lpfc driver poses significant risks to system stability and security. Users are urged to update their systems to the patched version as soon as possible to mitigate these risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38332 is a vulnerability in the Linux kernel's SCSI lpfc driver that can cause system crashes due to improper memory handling.
Debian 11, 12, and 13 are affected by this vulnerability, with specific fixes available for each version.
You can use tools like Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
If immediate updates are not possible, refrain from using the affected functionality until a patch can be applied.
While the primary concern is system stability, unexpected crashes could potentially lead to data loss. It is advisable to back up important data.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
