CVE-2025-38533 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix the using of Rx buffer DMA The wx_rx_buffer structure contained two DMA address fields: 'dma' and 'page_dma'. However, only 'page_dma' was actually initialized and used to program the Rx descriptor. But 'dma' was uninitialized and used in some paths. This could lead to undefined behavior, including DMA errors or use-after-free, if the uninitialized 'dma' was used. Althrough such error has not yet occurred, it is worth fixing in the code.
A vulnerability exists in the Linux kernel's handling of DMA addresses for received packets in the wx_rx_buffer structure, specifically within the net libwx component. The issue arises because the 'dma' field, intended for DMA address management, was left uninitialized and could potentially be used incorrectly, leading to undefined behavior such as DMA errors or use-after-free conditions. Although this error has not yet been observed, it has been addressed in the code to prevent future occurrences.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the Linux kernel official website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/027701180a7bcb64c42eab291133ef0c87b5b6c5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/05c37b574997892a40a0e9b9b88a481566b2367d | kernel.org | Patch |
| https://git.kernel.org/stable/c/5fd77cc6bd9b368431a815a780e407b7781bcca0 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ba7c793f96c1c2b944bb6f423d7243f3afc30fe9 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.3, < 6.6.100 >= 6.7, < 6.12.40 >= 6.13, < 6.15.8 6.16 rc1 6.16 rc2 6.16 rc3 6.16 rc4 6.16 rc5 6.16 rc6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Nov 18, 2025 | Initial Analysis | [email protected] |
| Aug 16, 2025 | New CVE Received | kernel.org |