Security readout for executives and security teams
Plain-English summary
This is a Linux kernel driver cleanup bug in the Freescale/NXP eDMA driver. On platforms without an error IRQ, such as i.MX9, device removal can trigger a kernel warning and dump. The source bundle does not show remote exploitation, active exploitation, or business-impact scoring.
Executive priority
Handle through normal kernel maintenance unless affected embedded platforms are business-critical or showing kernel warnings. There is no source-backed evidence of active exploitation or remote compromise, but unresolved kernel dumps can affect operational stability.
Technical view
The fsl-edma dmaengine remove path called devm_free_irq without checking whether txirq or errirq existed. On i.MX9, missing errirq caused a devm_free_irq warning during deferred probe or remove. Kernel stable commits add IRQ presence checks before freeing.
Likely exposure
Exposure appears limited to Linux kernels using the fsl-edma DMA engine, especially NXP i.MX9 or similar embedded platforms. The bundle lists Linux kernel versions and stable commits but does not provide distro package mappings or deployment prevalence.
Exploitation context
CISA KEV status is false in the bundle. No cited source reports exploitation in the wild, exploit code, a remote attack path, or privilege requirements. Treat this as an operational kernel reliability issue unless vendor advisories state otherwise.
Researcher notes
Evidence is narrow: the description includes a warning stack trace and the fix theme, but no CVSS, CWE, attack vector, or distro mapping. Validation should focus on affected hardware, kernel branch, and presence of stable backports.
Mitigation direction
- Update to a kernel containing the referenced stable fixes or vendor backport.
- Check NXP, Linux distribution, and device vendor advisories for packaged fixes.
- Prioritize embedded systems using i.MX9 or fsl-edma hardware.
- Avoid assuming unrelated Linux systems are exposed without driver and hardware evidence.
Validation and detection
- Inventory kernel versions on devices using Freescale/NXP eDMA hardware.
- Confirm whether the fsl-edma driver is present and active.
- Check vendor kernel changelogs for the referenced stable commit IDs.
- Review kernel logs for devm_free_irq warnings during probe or device removal.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38479 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/55e2dbe2ba787d4fc2306f6bb2f43fb32176e184CVE reference, Linux
- https://git.kernel.org/stable/c/38ff8769074db27387cb2323aaa751e59d168e6aCVE reference, Linux
- https://git.kernel.org/stable/c/f3834d2d68749e4760c27325149765930ad876fdCVE reference, Linux
- https://git.kernel.org/stable/c/fa70c4c3c580c239a0f9e83a14770ab026e8d820CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.