GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38484 (GCVE-0-2025-38484)

Vulnerability from cvelistv5 – Published: 2025-07-28 11:21 – Updated: 2026-08-05 12:02
VLAI
Title
iio: backend: fix out-of-bound write
Summary
In the Linux kernel, the following vulnerability has been resolved: iio: backend: fix out-of-bound write The buffer is set to 80 character. If a caller write more characters, count is truncated to the max available space in "simple_write_to_buffer". But afterwards a string terminator is written to the buffer at offset count without boundary check. The zero termination is written OUT-OF-BOUND. Add a check that the given buffer is smaller then the buffer to prevent.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: df3892e5e861c43d5612728ed259634675b8a71f , < 6eea9f7648ddb9e4903735a1f77cf196c957aa38 (git)
Affected: 035b4989211dc1c8626e186d655ae8ca5141bb73 , < 01e941aa7f5175125df4ac5d3aab099961525602 (git)
Affected: 035b4989211dc1c8626e186d655ae8ca5141bb73 , < da9374819eb3885636934c1006d450c3cb1a02ed (git)
Affected: 04271a4d2740f98bbe36f82cd3d74677a839d1eb (git)
Affected: fd791c81f410ab1c554686a6f486dc7a176dfe35 (git)
Affected: 6.12.23 , < 6.12.40 (semver)
Affected: 6.13.11 , < 6.14 (semver)
Affected: 6.14.2 , < 6.15 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.12.40 , ≤ 6.12.* (semver)
Unaffected: 6.15.8 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/industrialio-backend.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6eea9f7648ddb9e4903735a1f77cf196c957aa38",
              "status": "affected",
              "version": "df3892e5e861c43d5612728ed259634675b8a71f",
              "versionType": "git"
            },
            {
              "lessThan": "01e941aa7f5175125df4ac5d3aab099961525602",
              "status": "affected",
              "version": "035b4989211dc1c8626e186d655ae8ca5141bb73",
              "versionType": "git"
            },
            {
              "lessThan": "da9374819eb3885636934c1006d450c3cb1a02ed",
              "status": "affected",
              "version": "035b4989211dc1c8626e186d655ae8ca5141bb73",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "04271a4d2740f98bbe36f82cd3d74677a839d1eb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fd791c81f410ab1c554686a6f486dc7a176dfe35",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.40",
              "status": "affected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14",
              "status": "affected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThan": "6.15",
              "status": "affected",
              "version": "6.14.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/industrialio-backend.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "6.12.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.14.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: backend: fix out-of-bound write\n\nThe buffer is set to 80 character. If a caller write more characters,\ncount is truncated to the max available space in \"simple_write_to_buffer\".\nBut afterwards a string terminator is written to the buffer at offset count\nwithout boundary check. The zero termination is written OUT-OF-BOUND.\n\nAdd a check that the given buffer is smaller then the buffer to prevent."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only by a local `write(2)`/`pwrite(2)` on the debugfs file `/sys/kernel/debug/iio/iio:deviceN/backendM/direct_reg_access`. There is no network or remote data path into `iio_backend_debugfs_write_reg()`.\nAC:L - A single `write()` with any length \u2265 80 deterministically executes `buf[count] = \u0027\\0\u0027` out of bounds, and the attacker directly chooses the corruption offset via the syscall length. No race, no memory-layout precondition, and no unpredictable state is involved.\nPR:L - The debugfs node is created 0600, but debugfs on industrial/embedded IIO deployments is routinely mounted and permission-relaxed for instrumentation tooling, making the write reachable by an unprivileged local account; consistent with this CNA\u0027s scoring of comparable debugfs memory-corruption bugs (CVE-2026-43380, CVE-2026-46190). Choosing the higher-severity option where reachability depends on deployment configuration.\nUI:N - The attacker triggers the bug entirely on their own with one write syscall against an already-present device node. No action by any other user or administrator is required.\nS:U - The out-of-bounds write corrupts kernel memory within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Attacker-controlled stack corruption at a chosen offset can truncate saved pointers and length/size fields, which is readily leveraged into kernel memory disclosure, and full kernel compromise implies unrestricted read of system memory.\nI:H - This is a direct out-of-bounds write with an attacker-chosen offset spanning the kernel stack (return addresses, saved registers, stack canary) and, on non-VMAP_STACK builds, adjacent lowmem \u2014 a NUL-byte poisoning primitive usable for control-flow hijack and privilege escalation.\nA:H - Overwriting the stack canary, a return address, or hitting the VMAP_STACK guard page with a large offset causes an immediate kernel panic/oops, and the write can be repeated at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:16.576Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6eea9f7648ddb9e4903735a1f77cf196c957aa38"
        },
        {
          "url": "https://git.kernel.org/stable/c/01e941aa7f5175125df4ac5d3aab099961525602"
        },
        {
          "url": "https://git.kernel.org/stable/c/da9374819eb3885636934c1006d450c3cb1a02ed"
        }
      ],
      "title": "iio: backend: fix out-of-bound write",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38484",
    "datePublished": "2025-07-28T11:21:48.690Z",
    "dateReserved": "2025-04-16T04:51:24.021Z",
    "dateUpdated": "2026-08-05T12:02:16.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38484",
      "date": "2026-09-16",
      "epss": "0.00146",
      "percentile": "0.04193"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38484\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-28T12:15:30.367\",\"lastModified\":\"2026-07-30T06:23:20.450\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niio: backend: fix out-of-bound write\\n\\nThe buffer is set to 80 character. If a caller write more characters,\\ncount is truncated to the max available space in \\\"simple_write_to_buffer\\\".\\nBut afterwards a string terminator is written to the buffer at offset count\\nwithout boundary check. The zero termination is written OUT-OF-BOUND.\\n\\nAdd a check that the given buffer is smaller then the buffer to prevent.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iio: backend: correcci\u00f3n de escritura fuera de l\u00edmite. El b\u00fafer est\u00e1 configurado a 80 caracteres. Si quien llama escribe m\u00e1s caracteres, count se trunca al espacio m\u00e1ximo disponible en \\\"simple_write_to_buffer\\\". Posteriormente, se escribe un terminador de cadena en el b\u00fafer en el desplazamiento count sin verificaci\u00f3n de los l\u00edmites. La terminaci\u00f3n cero se escribe OUT-OF-BOUND. Para evitarlo, se debe a\u00f1adir una verificaci\u00f3n de que el b\u00fafer dado sea menor que el b\u00fafer.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iio/industrialio-backend.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"df3892e5e861c43d5612728ed259634675b8a71f\",\"lessThan\":\"6eea9f7648ddb9e4903735a1f77cf196c957aa38\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"035b4989211dc1c8626e186d655ae8ca5141bb73\",\"lessThan\":\"01e941aa7f5175125df4ac5d3aab099961525602\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"035b4989211dc1c8626e186d655ae8ca5141bb73\",\"lessThan\":\"da9374819eb3885636934c1006d450c3cb1a02ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04271a4d2740f98bbe36f82cd3d74677a839d1eb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fd791c81f410ab1c554686a6f486dc7a176dfe35\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.12.23\",\"lessThan\":\"6.12.40\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.13.11\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.14.2\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iio/industrialio-backend.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.40\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.8\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.23\",\"versionEndExcluding\":\"6.12.40\",\"matchCriteriaId\":\"526F5C6A-20E7-48A9-A397-8A16EC1E4B05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13.11\",\"versionEndExcluding\":\"6.14\",\"matchCriteriaId\":\"124AE182-7E9F-4410-9E08-5976ED49C6A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14.2\",\"versionEndExcluding\":\"6.15.8\",\"matchCriteriaId\":\"DF824E50-6D02-44EE-9300-88DB709E0B4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"85421F4E-C863-4ABF-B4B4-E887CC2F7F92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3827F0D4-5FEE-4181-B267-5A45E7CA11FC\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/01e941aa7f5175125df4ac5d3aab099961525602\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6eea9f7648ddb9e4903735a1f77cf196c957aa38\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da9374819eb3885636934c1006d450c3cb1a02ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:23:27+00:00",
      "cve": "CVE-2025-38484",
      "id": "CVE-2025-38484",
      "initial_release_date": "2025-07-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iio: backend: fix out-of-bound write",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38484.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:48:46Z",
      "cve": "CVE-2025-38484",
      "id": "CVE-2025-38484",
      "initial_release_date": "2025-07-28T23:22:39Z",
      "product_status:first_fixed": "2",
      "product_status:known_not_affected": "524",
      "product_status:recommended": "154",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38484",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38484.json",
      "version": "25"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.