Security readout for executives and security teams
Plain-English summary
A low-privileged local user may be able to trigger a heap overwrite in the Linux kernel’s RapidIO connection-management driver. Successful exploitation could compromise confidentiality, integrity, and availability. The issue is serious where RapidIO support and its character-device interface are present, but it is not described as remotely exploitable.
Executive priority
Prioritize prompt remediation on multi-user or less-trusted Linux systems using RapidIO. Other systems should be inventoried and validated before emergency action. Treat as high impact but not an internet-wide remote emergency based on the supplied evidence.
Technical view
The RIO_CM_CHAN_SEND ioctl path validated the maximum message size but not whether userspace supplied enough data for a complete rio_ch_chan_hdr. riocm_ch_send() could consequently write header fields beyond the allocated heap buffer. The kernel fix verifies that the complete header was copied before those fields are written.
Likely exposure
Exposure likely requires a vulnerable Linux kernel, the RapidIO connection-management driver and device interface, and local low-privileged access. Systems without this driver or accessible interface are less likely to be exposed. The supplied version list is insufficiently precise for reliable range interpretation, so confirm status against the running distribution kernel.
Exploitation context
The CVSS vector rates exploitation as local, low complexity, requiring low privileges and no user interaction, with potentially high confidentiality, integrity, and availability impact. The source bundle states KEV is false and provides no evidence of active exploitation or a public exploit.
Researcher notes
The vulnerable path is riocm_cdev_ioctl(RIO_CM_CHAN_SEND) through cm_chan_msg_send() to riocm_ch_send(). The defect is an undersized-input validation failure leading to an out-of-bounds heap write. The bundle contains duplicate commit identifiers and flattened version data, limiting precise affected-range conclusions.
Mitigation direction
- Install the applicable vendor or distribution kernel security update containing the upstream fix.
- If patching is delayed, assess whether RapidIO support can be disabled without operational impact.
- Restrict local account and device-interface access according to least privilege.
- Check current Linux distribution advisories for supported-package remediation guidance.
Validation and detection
- Record each system’s running kernel release, build, and distribution package version.
- Determine whether the RapidIO connection-management driver is built, loaded, or operationally required.
- Verify which users can access the relevant RapidIO character-device interface.
- Confirm the installed kernel includes the applicable upstream fix or distribution backport.
- After updating, reboot into the corrected kernel and verify the running version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38090 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a8b5ea2e302aa5cd00fc7addd8df53c9bde7b5f6CVE reference, Linux
- https://git.kernel.org/stable/c/c03ddc183249f03fc7e057e02cae6f89144d0123CVE reference, Linux
- https://git.kernel.org/stable/c/58f664614f8c3d6142ab81ae551e466dc6e092e8CVE reference, Linux
- https://git.kernel.org/stable/c/ecf5ee280b702270afb02f61b299d3dfe3ec7730CVE reference, Linux
- https://git.kernel.org/stable/c/1921781ec4a8824bd0c520bf9363e28a880d14ecCVE reference, Linux
- https://git.kernel.org/stable/c/1cce6ac47f4a2ac1766b8a188dc8c8f6d8df2a53CVE reference, Linux
- https://git.kernel.org/stable/c/6d5c6711a55c35ce09b90705546050408d9d4b61CVE reference, Linux
- https://git.kernel.org/stable/c/50695153d7ddde3b1696dbf0085be0033bf3ddb3CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.