Security readout for executives and security teams
Plain-English summary
A Linux Dell BIOS update driver uses the wrong list starting point when handling firmware packets. Reading packet data can return incorrect contents, while clearing packets can crash the kernel through a NULL pointer dereference. Exploitation requires local, low-privileged access; the supplied evidence does not establish remote or active exploitation.
Executive priority
Treat as an accelerated patching item for exposed multi-user or Dell firmware-management systems. It is high severity because a local user may trigger incorrect data handling or a system crash, but current evidence does not justify emergency incident response based on active exploitation.
Technical view
CVE-2025-38197 affects list traversal in platform/x86/dell_rbu. The wrong list head is passed to list_for_each_entry-style processing, causing packet reads through sysfs to begin incorrectly and packet-list clearing to dereference NULL. The supplied CVSS 3.1 score is 7.3 with local access, low complexity, low privileges, no user interaction, and high availability impact.
Likely exposure
Exposure is most likely on affected Linux kernels where the Dell RBU driver and relevant sysfs packet operations are available. Local access and low privileges are required according to the CVSS vector. The flattened version data is ambiguous, so confirm affected and fixed releases through kernel or distribution advisories.
Exploitation context
The source bundle marks this CVE as absent from KEV and provides no evidence of exploitation in the wild. The documented outcomes are incorrect packet-data disclosure and a kernel NULL pointer dereference. No evidence establishes remote reachability, privilege escalation, or reliable code execution.
Researcher notes
The affected-version array appears flattened and includes both release numbers and repeated commit identifiers, preventing reliable range interpretation from this bundle alone. The description directly supports incorrect sysfs output and NULL-dereference denial of service. Although the CVSS vector claims high confidentiality impact, the supplied narrative does not explain its scope.
Mitigation direction
- Install a vendor-supported kernel containing the cited stable fix.
- Check Linux distribution advisories for the exact corrected package version.
- Prioritize shared systems where untrusted users have local accounts.
- Restrict unnecessary local access while patching is pending.
Validation and detection
- Inventory kernel versions on systems using the Dell RBU driver.
- Determine whether the driver and relevant sysfs interfaces are present.
- Compare installed packages with distribution security advisories.
- Confirm the installed kernel incorporates the applicable stable commit.
- Test firmware-update workflows safely after upgrading.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38197 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5e8c658acd1b7c186aeffa46bf08795e121f401aCVE reference, Linux
- https://git.kernel.org/stable/c/07d7b8e7ef7d1f812a6211ed531947c56d09e95eCVE reference, Linux
- https://git.kernel.org/stable/c/a7b477b64ef5e37cb08dd536ae07c46f9f28262eCVE reference, Linux
- https://git.kernel.org/stable/c/f3b840fb1508a80cd8a0efb5c886ae1995a88b24CVE reference, Linux
- https://git.kernel.org/stable/c/4d71f2c1e5263a9f042faa71d59515709869dc79CVE reference, Linux
- https://git.kernel.org/stable/c/32d05e6cc3a7bf6c8f16f7b7ef8fe80eca0c233eCVE reference, Linux
- https://git.kernel.org/stable/c/61ce04601e0d8265ec6d2ffa6df5a7e1bce64854CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.