CVE-2025-38257
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
s390/pkey: Prevent overflow in size calculation for memdup_user()
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Prevent overflow in size calculation for memdup_user() Number of apqn target list entries contained in 'nr_apqns' variable is determined by userspace via an ioctl call so the result of the product in calculation of size passed to memdup_user() may overflow. In this case the actual size of the allocated area and the value describing it won't be in sync leading to various types of unpredictable behaviour later. Use a proper memdup_array_user() helper which returns an error if an overflow is detected. Note that it is different from when nr_apqns is initially zero - that case is considered valid and should be handled in subsequent pkey_handler implementations. Found by Linux Verification Center (linuxtesting.org).
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| f2bbc96e7cfad3891b7bf9bd3e566b9b7ab4553d | affected | git | ad1bdd24a02d5a8d119af8e4cd50933780a6d29f | Unavailable | None listed |
| f2bbc96e7cfad3891b7bf9bd3e566b9b7ab4553d | affected | git | faa1ab4a23c42e34dc000ef4977b751d94d5148c | Unavailable | None listed |
| f2bbc96e7cfad3891b7bf9bd3e566b9b7ab4553d | affected | git | 88f3869649edbc4a13f6c2877091f81cd5a50f05 | Unavailable | None listed |
| f2bbc96e7cfad3891b7bf9bd3e566b9b7ab4553d | affected | git | f855b119e62b004a5044ed565f2a2b368c4d3f16 | Unavailable | None listed |
| f2bbc96e7cfad3891b7bf9bd3e566b9b7ab4553d | affected | git | 73483ca7e07a5e39bdf612eec9d3d293e8bef649 | Unavailable | None listed |
| f2bbc96e7cfad3891b7bf9bd3e566b9b7ab4553d | affected | git | 7360ee47599af91a1d5f4e74d635d9408a54e489 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 5.4 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 5.4 | Unavailable | None listed |
| 5.15.187 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.143 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.96 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.36 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.15.5 | unaffected | semver | Unavailable | 6.15.* | None listed |
| 6.16 | unaffected | original_commit_for_fix | Unavailable | * | None listed |