Security readout for executives and security teams
Plain-English summary
A Linux Qualcomm SPI NAND driver can write beyond allocated memory during flash operations, corrupting kernel memory. Reported outcomes include write failures and kernel panics after reboot. Because successful abuse could compromise confidentiality, integrity, and availability, affected systems should be identified and updated promptly.
Executive priority
Treat as a high-priority platform issue for systems using the affected Qualcomm NAND driver. Validate exposure immediately and schedule vendor-supported updates promptly, especially where a crash, flash corruption, or local privilege compromise would disrupt critical services. Systems without the relevant driver and hardware are unlikely to be exposed.
Technical view
The qpic-snand driver initially sizes BAM transaction arrays for one codeword before the NAND geometry is known. Operations requiring additional transactions can access beyond those arrays, causing memory corruption. The resolution reallocates BAM transaction storage after the chip’s actual codeword count becomes known. CVSS 3.1 is 7.8 with local, low-privileged access required.
Likely exposure
Exposure is limited to Linux systems using the affected Qualcomm qpic-snand driver with applicable NAND hardware. The supplied record identifies affected 6.15-series and 6.16 data, but its version notation is ambiguous. Confirm exact vulnerable and fixed package versions with the system vendor or distribution.
Exploitation context
The supplied CVSS vector describes local exploitation requiring low privileges, low complexity, and no user interaction, with potential complete confidentiality, integrity, and availability impact. Testing reproduced memory corruption and kernel panics. The supplied record is not in KEV, and no evidence of active exploitation or a public exploit is provided.
Researcher notes
The demonstrated trigger involved mtd_nandbiterrs testing, but the root cause is undersized BAM transaction arrays during flash operations. The sources establish out-of-bounds access and memory corruption, not a proven privilege-escalation exploit. Exact affected release boundaries and exploitability under ordinary workloads remain insufficiently detailed in the supplied bundle.
Mitigation direction
- Apply a vendor-supported kernel update containing the referenced stable fix.
- Confirm distribution advisories because the supplied affected-version notation is ambiguous.
- Prioritize appliances or systems using Qualcomm SPI NAND hardware.
- Restrict local access and unnecessary low-privileged accounts until patched.
Validation and detection
- Inventory kernel versions and determine whether the qpic-snand driver is present and used.
- Verify the installed kernel contains either referenced stable correction or its vendor backport.
- Review logs for qcom_snand mapping failures, raw-page write failures, or related kernel panics.
- After updating, confirm normal NAND operations and successful reboot using approved operational tests.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38398 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/86fb36de1132b560f9305f0c78fa69f459fa0980CVE reference, Linux
- https://git.kernel.org/stable/c/d85d0380292a7e618915069c3579ae23c7c80339CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.