Out-of-Bounds Write Vulnerability in Linux Kernel - lan743x Package
Summary
CVE-2025-38183: In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() Before calling lan743x_ptp_io_event_clock_get(), the 'channel' value... Affects linux versions < 6.1.147-1. Fixed in 6.1.147-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The lan743x package is a driver for LAN743x Ethernet controllers, which are used in various networking applications. This package is crucial for ensuring proper communication between the operating system and the hardware, enabling efficient data transfer and network connectivity.
Vulnerability Detail
The vulnerability identified as CVE-2025-38183 involves a potential out-of-bounds write in the function lan743x_ptp_io_event_clock_get(). The issue arises when the function writes to an array ptp->extts[] using a channel index that could exceed the array's bounds. Although the channel value is checked against a maximum value, the array only has 4 elements, leading to a risk of writing outside its allocated memory. This could result in data corruption or system instability, making it a critical issue that needs to be addressed.
How To Fix
Minimum fixed version
6.1.147-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually adjust the LAN743X_PTP_N_EXTTS value to 8 in the source code before recompiling the driver. This adjustment will prevent out-of-bounds writes by ensuring that the channel index does not exceed the array size.
Conclusion
CVE-2025-38183 is a significant vulnerability in the Linux kernel's lan743x package that can lead to out-of-bounds writes. It is crucial for users to update their systems to mitigate the risks associated with this vulnerability. Utilizing tools like Vulert can help monitor and alert users to such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38183 is a vulnerability in the Linux kernel related to the lan743x package, which can lead to an out-of-bounds write due to improper handling of array indices.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
The risks include potential data corruption, system instability, and exploitation by malicious actors, which could compromise system security.
Yes, a patch is available. Users should update their Linux package to the latest version that includes the fix for CVE-2025-38183.
If an immediate update is not possible, consider applying the workaround by adjusting the LAN743X_PTP_N_EXTTS value in the source code to prevent out-of-bounds writes.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
