LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38548: hwmon: (corsair-cpro) Validate the size of the received input buffer

In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Validate the size of the received input buffer Add buffer_recv_size to store the size of the received bytes. Validate buffer_recv_size in send_usb_cmd().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-38548 is a Linux kernel issue in the corsair-cpro hardware monitoring driver. The fix adds size tracking and validation for data received from the device path. Public sources do not state business impact, CVSS severity, or active exploitation, so urgency depends on whether affected kernels and this driver are present.

Executive priority

Handle through normal kernel patch governance unless asset inventory shows widespread use of the corsair-cpro driver. There is insufficient public evidence for emergency treatment, but kernel issues still warrant timely remediation because impact details are incomplete.

Technical view

The vulnerability was resolved by storing the received byte count in buffer_recv_size and validating that size in send_usb_cmd(). The affected area is hwmon/corsair-cpro. The source bundle lists multiple Linux stable fixes and Debian LTS announcements, but does not identify a CWE, CVSS score, crash condition, privilege boundary, or exploit primitive.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions where the corsair-cpro hwmon driver is present or usable. The bundle lists Linux kernel versions as affected and provides stable-tree fix references. It does not confirm default enablement, remote reachability, or distribution-specific exposure beyond Debian LTS notices.

Exploitation context

There is no KEV listing and the provided sources do not report active exploitation, public exploit availability, or weaponized use. Treat exploitation status as unconfirmed. The available evidence only supports that a kernel input-buffer size validation defect was fixed.

Researcher notes

Key unknowns are impact, attacker position, trigger conditions, and whether malformed USB-device responses are required. The fix description points to missing receive-buffer size validation in send_usb_cmd(), but the bundle does not provide enough detail to assert memory corruption, privilege escalation, or denial of service.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable fixes.
  • Review Debian LTS advisories if running affected Debian kernel packages.
  • Check Linux distribution guidance before using unsupported workarounds.
  • Prioritize systems where corsair-cpro hardware monitoring is enabled.
  • Avoid direct wrangler or deploy assumptions; this CVE is kernel-specific.

Validation and detection

  • Inventory Linux kernel versions against the affected and fixed versions listed by vendors.
  • Check whether the corsair-cpro hwmon driver is built, loaded, or required.
  • Confirm installed kernel packages include the relevant stable backport.
  • Review Debian LTS notices for package-specific fixed versions.
  • Document systems where exposure cannot be confirmed from available telemetry.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38548 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux40c3a445422579db8ad96c234dbe6c0ab3f6b936, 40c3a445422579db8ad96c234dbe6c0ab3f6b936, 40c3a445422579db8ad96c234dbe6c0ab3f6b936, 40c3a445422579db8ad96c234dbe6c0ab3f6b936, 40c3a445422579db8ad96c234dbe6c0ab3f6b936, 40c3a445422579db8ad96c234dbe6c0ab3f6b936, 40c3a445422579db8ad96c234dbe6c0ab3f6b936unaffected
LinuxLinux5.9, 0, 5.10.241, 5.15.190, 6.1.147, 6.6.100, 6.12.40, 6.15.8, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.