PT-2025-28997 · Linux+6 · Linux Kernel+6
Anubis
·
Published
2025-04-09
·
Updated
2026-04-20
·
CVE-2025-38277
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
The Linux kernel contains an issue where an uninitialized variable
ret is used in the ecc-mxic functionality within the MTD/NAND subsystem. If ctx->steps is zero, the ECC step processing loop is skipped, leaving ret uninitialized. A subsequent check and return of this uninitialized value can lead to undefined behavior, potentially causing kernel crashes or unpredictable results in user space. This can be triggered by misconfigured geometry, ECC engine misuse, or a lack of validation for ctx->steps after initialization. The issue was discovered by the Linux Verification Center (linuxtesting.org) using SVACE.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use of Uninitialized Resource
Improper Initialization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu