Memory Corruption Vulnerability in Linux Kernel - CVE-2025-38401
Summary
CVE-2025-38401: In the Linux kernel, the following vulnerability has been resolved: mtk-sd: Prevent memory corruption from DMA map failure If msdc_prepare_data() fails to map the DMA region, the request is not prepared for data receivin... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used across various platforms, including servers, desktops, and embedded systems. The kernel's functionality includes process management, memory management, device drivers, and system calls. This vulnerability specifically affects the MediaTek SD (mtk-sd) driver, which is responsible for handling SD card operations, making it critical for systems relying on SD card storage.
Vulnerability Detail
In the Linux kernel, a vulnerability identified as CVE-2025-38401 has been discovered in the mtk-sd driver. This issue arises when the msdc_prepare_data() function fails to map the DMA (Direct Memory Access) region correctly. If this failure occurs, the request is not prepared for data reception, yet the msdc_start_data() function continues to execute the DMA operation with the previous settings. This can lead to memory corruption, potentially compromising system stability and security. The vulnerability is present in Debian versions 11, 12, and 13, with a fix available in version 6.12.37-1 for Debian 13.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the mtk-sd driver until the system is updated with the patched version. This may involve using alternative storage solutions or drivers that do not exhibit this vulnerability.
Conclusion
CVE-2025-38401 is a critical vulnerability in the Linux kernel's mtk-sd driver that can lead to memory corruption. Users are advised to update their systems to the patched version to mitigate risks. Utilizing tools like Vulert can help monitor and identify vulnerabilities in open-source software effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38401 is a vulnerability in the Linux kernel's mtk-sd driver that can lead to memory corruption due to improper handling of DMA mapping failures.
If exploited, this vulnerability can cause memory corruption, potentially leading to system instability, crashes, or unauthorized access to sensitive data.
Debian versions 11, 12, and 13 are affected by this vulnerability, with a specific fix available for Debian 13.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, consider using alternative storage solutions or drivers that do not rely on the mtk-sd driver until a patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
