Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s Marvell CESA cryptographic driver can access unintended memory when processing a zero-length encryption request. The kernel fix returns immediately instead. Although rated high severity, practical exposure depends on whether the affected driver is available and reachable on a system.
Executive priority
Treat this as a high-priority kernel maintenance issue on systems using Marvell CESA, especially multi-user or shared-compute hosts. Prioritize exposure discovery before emergency-wide action because the evidence does not establish remote or active exploitation. Apply supported kernel updates through normal expedited patching processes.
Technical view
The marvell/cesa skcipher path failed to handle zero-length requests safely and could access random memory. CVSS 3.1 scores it 7.8 with a local, low-complexity, low-privilege attack model and potential confidentiality, integrity, and availability impact. The supplied sources do not detail the precise memory-access primitive or demonstrated consequences.
Likely exposure
Exposure is most likely on affected Linux kernels using or enabling the Marvell CESA cryptographic driver. Systems without that driver or relevant hardware may not be practically exposed. The supplied version data is insufficient to determine an individual system’s status without checking its distribution kernel and included patches.
Exploitation context
The supplied record is not in KEV, and no cited source reports active exploitation or provides a public proof of concept. The CVSS vector assumes local access with low privileges; it does not indicate remote exploitation. Real-world exploitability remains unclear from the available evidence.
Researcher notes
The core defect and correction are clearly described, but the bundle omits affected hardware details, a CWE, proof of concept, crash evidence, and the exact consequences of the memory access. The CVSS claims complete confidentiality, integrity, and availability impact, but those outcomes are not demonstrated in the supplied narrative. Validate branch-specific fixes carefully.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the appropriate stable fix for CVE-2025-38173.
- Prioritize systems where marvell/cesa is enabled and untrusted local users or workloads are present.
- Reboot as required by vendor instructions so the corrected kernel becomes active.
- If patching is delayed, request vendor guidance before disabling the affected driver or cryptographic functionality.
Validation and detection
- Inventory running kernel builds and compare them with distribution advisories and the listed stable fixes.
- Determine whether the marvell/cesa driver is present, enabled, built in, or loaded.
- Verify the running kernel incorporates an applicable listed fix, not merely that an updated package is installed.
- In an authorized test environment, confirm zero-length skcipher requests return safely without invalid memory access.
- Review kernel fault logs for events involving Marvell CESA cryptographic processing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38173 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/32d3e8049a8b60f18c5c39f5931bfb1130ac11c9CVE reference, Linux
- https://git.kernel.org/stable/c/c064ae2881d839709bd72d484d5f2af157f46024CVE reference, Linux
- https://git.kernel.org/stable/c/e1cc69da619588b1488689fe3535a0ba75a2b0e7CVE reference, Linux
- https://git.kernel.org/stable/c/78ea1ff6cb413a03ff6f7af4e28e24b4461a0965CVE reference, Linux
- https://git.kernel.org/stable/c/5e9666ac8b94c978690f937d59170c5237bd2c45CVE reference, Linux
- https://git.kernel.org/stable/c/7894694b5d5b2ecfd7fb081d6f60b9e169ab4d13CVE reference, Linux
- https://git.kernel.org/stable/c/c9610dda42bd382a96f97e68825cb5f66cd9e1dcCVE reference, Linux
- https://git.kernel.org/stable/c/8a4e047c6cc07676f637608a9dd675349b5de0a7CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.