Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s MediaTek SD-card driver can corrupt kernel memory when a data-transfer setup fails but the driver continues using old DMA settings. Successful exploitation requires local access under the supplied CVSS assessment, but impact could include data disclosure, system compromise, or a crash.
Executive priority
Treat this as a high-priority kernel maintenance issue for affected MediaTek-based systems, especially shared devices or systems permitting local untrusted users. It is not presented as an internet-exploitable emergency or actively exploited threat. Establish exposure promptly, then deploy supported corrected kernels through normal expedited change controls.
Technical view
If msdc_prepare_data() cannot map a DMA region, the request remains unprepared. msdc_start_data() nevertheless starts DMA using settings from a previous request, creating a kernel-memory corruption condition. The supplied CVSS 3.1 score is 7.8: local vector, low complexity, low privileges, no user interaction, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely on systems running an affected Linux release where the mtk-sd driver supports relevant MediaTek SD hardware. The supplied version data spans multiple kernel branches but is not sufficiently clear to determine every vulnerable or fixed package version. Remote-only systems have reduced direct exposure because the rated attack vector is local.
Exploitation context
The source bundle provides no evidence of active exploitation, and the CVE is not identified as being in KEV. The CVSS assessment indicates a local attacker with low privileges could potentially trigger high-impact memory corruption without user interaction. No public exploit or demonstrated exploitation is established by the supplied evidence.
Researcher notes
The failure path permits DMA to proceed with stale configuration after mapping fails. The supplied affected-version records are ambiguous because they mix release versions and repeated commit identifiers. Branch-level remediation should therefore be confirmed by commit inclusion or distribution advisories. The bundle does not identify a CWE, trigger conditions beyond DMA mapping failure, proof of concept, or exploitation telemetry.
Mitigation direction
- Apply a vendor-supported kernel update containing the appropriate referenced stable fix.
- Confirm the corrected kernel is installed and active after rebooting.
- Prioritize systems using the mtk-sd driver on relevant MediaTek hardware.
- If updates are unavailable, consult Linux or distribution guidance for supported mitigations.
Validation and detection
- Inventory running kernel versions and identify systems loading the mtk-sd driver.
- Map each kernel branch to the applicable referenced stable commit.
- Verify distribution packages include the fix; version numbers alone may be insufficient.
- After updating, confirm systems booted into the corrected kernel.
- Monitor kernel logs for DMA, mtk-sd, memory-corruption, or unexpected crash events.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 5ac9e9e2
- Linux stable commit d5477157
- Linux stable commit 48bf4f3d
- Linux stable commit 63e8953f
- Linux stable commit 61cdd663
- Linux stable commit 3419bc6a
- Linux stable commit a5f5f67b
- Linux stable commit f5de4699
- Debian LTS announcement 2025/10/08
- Debian LTS announcement 2025/10/07
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38401 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5ac9e9e2e9cd6247d8c2d99780eae4556049e1ccCVE reference, Linux
- https://git.kernel.org/stable/c/d54771571f74a82c59830a32e76af78a8e57ac69CVE reference, Linux
- https://git.kernel.org/stable/c/48bf4f3dfcdab02b22581d8e350a2d23130b72c0CVE reference, Linux
- https://git.kernel.org/stable/c/63e8953f16acdcb23e2d4dd8a566d3c34df3e200CVE reference, Linux
- https://git.kernel.org/stable/c/61cdd663564674ea21ceb50aa9d3697cbe9e45f9CVE reference, Linux
- https://git.kernel.org/stable/c/3419bc6a7b65cbbb91417bb9970208478e034c79CVE reference, Linux
- https://git.kernel.org/stable/c/a5f5f67b284d81776d4a3eb1f8607e4b7f91f11cCVE reference, Linux
- https://git.kernel.org/stable/c/f5de469990f19569627ea0dd56536ff5a13beaa3CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.