PT-2025-27719 · Linux+1 · Linux Kernel+1

Published 2025-05-09 · Updated 2025-07-03 · CVE-2025-38133

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: A vulnerability in the Linux kernel has been resolved. The issue was related to the ad4851 parse channels common() function, where the pointer returned was incremented internally as each channel was populated. In the ad4858 parse channels() function, the same pointer was further incremented while setting ext scan type fields for each channel, potentially causing memory corruption or undefined behavior. This was fixed by iterating over the channels using an explicit index instead of incrementing the pointer, preserving the original base pointer and ensuring all channel metadata is set correctly.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2025-09625

CVE-2025-38133

Affected Products

Astra Linux

Linux Kernel

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38133.json · Exploit
• https://cve.org/CVERecord?id=CVE-2025-38133 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38133 · Security Note
• https://bdu.fstec.ru/vul/2025-09625 · Security Note
• https://ubuntu.com/security/CVE-2025-38133 · Vendor Advisory
• https://git.kernel.org/stable/c/499a8cee812588905cc940837e69918c1649a19e · Patch
• https://git.kernel.org/stable/c/6c3b9e1167d072ce2d01cafec7866647cf8d3616 · Patch
• https://osv.dev/vulnerability/CVE-2025-38133 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-38133 · Vendor Advisory
• https://git.kernel.org/linus/499a8cee812588905cc940837e69918c1649a19e · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://access.redhat.com/security/cve/CVE-2025-38133 · Note
• https://twitter.com/VulmonFeeds/status/1940803925830984101 · Twitter Post
• https://twitter.com/CVEnew/status/1940701624998969665 · Twitter Post
• https://lore.kernel.org/linux-cve-announce/2025070331-CVE-2025-38133-5976@gregkh · Note