{"schema_version":"1.7.5","id":"CVE-2025-38428","published":"2025-07-25T14:16:48.019Z","modified":"2026-07-15T01:49:17.111224790Z","related":["SUSE-SU-2025:02853-1","SUSE-SU-2025:02923-1","SUSE-SU-2025:02969-1","SUSE-SU-2025:02996-1","SUSE-SU-2025:02997-1","SUSE-SU-2025:03011-1","SUSE-SU-2025:03023-1","SUSE-SU-2025:20577-1","SUSE-SU-2025:20586-1","SUSE-SU-2025:20601-1","SUSE-SU-2025:20602-1","SUSE-SU-2025:21074-1","SUSE-SU-2025:21139-1","SUSE-SU-2025:21179-1","SUSE-SU-2026:20560-1","openSUSE-SU-2025:20081-1"],"summary":"Input: ims-pcu - check record size in ims_pcu_flash_firmware()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: ims-pcu - check record size in ims_pcu_flash_firmware()\n\nThe \"len\" variable comes from the firmware and we generally do\ntrust firmware, but it's always better to double check.  If the \"len\"\nis too large it could result in memory corruption when we do\n\"memcpy(fragment->data, rec->data, len);\"","affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"628329d52474323938a03826941e166bc7c8eff4"},{"fixed":"c1b9d140b0807c6aee4bb53e1bfa4e391e3dc204"},{"fixed":"d63706d9f73846106fde28b284f08e01b92ce9f1"},{"fixed":"e5a2481dc2a0b430f49276d7482793a8923631d6"},{"fixed":"8e03f1c7d50343bf21da54873301bc4fa647479f"},{"fixed":"17474a56acf708bf6b2d174c06ed26abad0a9fd6"},{"fixed":"5a8cd6ae8393e2eaebf51d420d5374821ef2af87"},{"fixed":"74661516daee1eadebede8dc607b6830530096ec"},{"fixed":"a95ef0199e80f3384eb992889322957d26c00102"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38428.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10.0"},{"fixed":"5.4.295"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.10.239"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.186"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.142"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.95"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.35"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.15.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38428.json"}}],"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/17474a56acf708bf6b2d174c06ed26abad0a9fd6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5a8cd6ae8393e2eaebf51d420d5374821ef2af87"},{"type":"WEB","url":"https://git.kernel.org/stable/c/74661516daee1eadebede8dc607b6830530096ec"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8e03f1c7d50343bf21da54873301bc4fa647479f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a95ef0199e80f3384eb992889322957d26c00102"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c1b9d140b0807c6aee4bb53e1bfa4e391e3dc204"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d63706d9f73846106fde28b284f08e01b92ce9f1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e5a2481dc2a0b430f49276d7482793a8923631d6"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38428.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38428"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38428.json"}}