Critical Vulnerability in Linux Kernel Affecting Debian Packages: CVE-2025-38422
Summary
CVE-2025-38422: In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices Maximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb and 64 Kb respec... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of hardware architectures and is known for its stability and performance. However, vulnerabilities in the kernel can lead to severe security risks, including unauthorized access and data corruption. This specific vulnerability, CVE-2025-38422, affects the handling of EEPROM and OTP sizes for PCI1xxxx devices, which could lead to out-of-bounds read/write operations.
Vulnerability Detail
CVE-2025-38422 is a vulnerability in the Linux kernel that affects the net subsystem, specifically the lan743x driver. The issue arises from incorrect handling of EEPROM and OTP sizes for PCI1xxxx devices, which are defined as having maximum sizes of 8 Kb and 64 Kb, respectively. This flaw allows for potential out-of-bounds read/write operations, which could lead to memory corruption, data leakage, or even system crashes. The vulnerability was introduced in the kernel and has been resolved in the patched versions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-38422 is a critical vulnerability in the Linux kernel that affects Debian packages, specifically related to EEPROM and OTP size handling. Users are advised to update their systems to the patched version to mitigate potential risks. Regular monitoring using tools like Vulert can help maintain security against such vulnerabilities.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38422 is a vulnerability in the Linux kernel affecting the handling of EEPROM and OTP sizes for PCI1xxxx devices, leading to potential out-of-bounds read/write operations.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The vulnerability can lead to memory corruption, data leakage, or system crashes, posing significant security risks to affected systems.
You can update your Linux kernel package by running 'sudo apt-get update && sudo apt-get install linux=6.12.35-1' in the terminal for Debian 13.
Currently, there are no specific workarounds available. The recommended action is to apply the patch as soon as it is released.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
