In the Linux kernel, the following vulnerability has been resolved:
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
In
riocmcdevioctl(RIOCMCHANSEND) -> cmchanmsgsend() -> riocmchsend()
cmchanmsgsend() checks that userspace didn't send too much data but riocmchsend() failed to check that userspace sent sufficient data. The result is that riocmchsend() can write to fields in the riochchanhdr which were outside the bounds of the space which cmchanmsg_send() allocated.
Address this by teaching riocmchsend() to check that the entire riochchan_hdr was copied in from userspace.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58f664614f8c3d6142ab81ae551e466dc6e092e8",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38090-13afbe4c",
"target": {
"file": "drivers/rapidio/rio_cm.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"136653990216961687938803460633353463921",
"188964775421901971752600843527731455307",
"153923915070995463870993729100289006897"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d5c6711a55c35ce09b90705546050408d9d4b61",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38090-1653a410",
"target": {
"function": "riocm_ch_send",
"file": "drivers/rapidio/rio_cm.c"
},
"signature_type": "Function",
"digest": {
"length": 1008.0,
"function_hash": "107305411807121224461095496106014976104"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecf5ee280b702270afb02f61b299d3dfe3ec7730",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38090-1b379bb6",
"target": {
"file": "drivers/rapidio/rio_cm.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"136653990216961687938803460633353463921",
"188964775421901971752600843527731455307",
"153923915070995463870993729100289006897"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50695153d7ddde3b1696dbf0085be0033bf3ddb3",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38090-20ae97e9",
"target": {
"function": "riocm_ch_send",
"file": "drivers/rapidio/rio_cm.c"
},
"signature_type": "Function",
"digest": {
"length": 1008.0,
"function_hash": "107305411807121224461095496106014976104"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8b5ea2e302aa5cd00fc7addd8df53c9bde7b5f6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38090-71c019d3",
"target": {
"function": "riocm_ch_send",
"file": "drivers/rapidio/rio_cm.c"
},
"signature_type": "Function",
"digest": {
"length": 1008.0,
"function_hash": "107305411807121224461095496106014976104"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50695153d7ddde3b1696dbf0085be0033bf3ddb3",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38090-92e43a11",
"target": {
"file": "drivers/rapidio/rio_cm.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"136653990216961687938803460633353463921",
"188964775421901971752600843527731455307",
"153923915070995463870993729100289006897"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d5c6711a55c35ce09b90705546050408d9d4b61",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38090-9671b854",
"target": {
"file": "drivers/rapidio/rio_cm.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"136653990216961687938803460633353463921",
"188964775421901971752600843527731455307",
"153923915070995463870993729100289006897"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cce6ac47f4a2ac1766b8a188dc8c8f6d8df2a53",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38090-9689f37b",
"target": {
"file": "drivers/rapidio/rio_cm.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"136653990216961687938803460633353463921",
"188964775421901971752600843527731455307",
"153923915070995463870993729100289006897"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8b5ea2e302aa5cd00fc7addd8df53c9bde7b5f6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38090-99e1ef6c",
"target": {
"file": "drivers/rapidio/rio_cm.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"136653990216961687938803460633353463921",
"188964775421901971752600843527731455307",
"153923915070995463870993729100289006897"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1921781ec4a8824bd0c520bf9363e28a880d14ec",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38090-acb6826c",
"target": {
"function": "riocm_ch_send",
"file": "drivers/rapidio/rio_cm.c"
},
"signature_type": "Function",
"digest": {
"length": 1008.0,
"function_hash": "107305411807121224461095496106014976104"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c03ddc183249f03fc7e057e02cae6f89144d0123",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38090-add3251f",
"target": {
"function": "riocm_ch_send",
"file": "drivers/rapidio/rio_cm.c"
},
"signature_type": "Function",
"digest": {
"length": 1008.0,
"function_hash": "107305411807121224461095496106014976104"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1921781ec4a8824bd0c520bf9363e28a880d14ec",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38090-c8c7c681",
"target": {
"file": "drivers/rapidio/rio_cm.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"136653990216961687938803460633353463921",
"188964775421901971752600843527731455307",
"153923915070995463870993729100289006897"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cce6ac47f4a2ac1766b8a188dc8c8f6d8df2a53",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38090-d1969b5c",
"target": {
"function": "riocm_ch_send",
"file": "drivers/rapidio/rio_cm.c"
},
"signature_type": "Function",
"digest": {
"length": 1008.0,
"function_hash": "107305411807121224461095496106014976104"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58f664614f8c3d6142ab81ae551e466dc6e092e8",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38090-e1d8daae",
"target": {
"function": "riocm_ch_send",
"file": "drivers/rapidio/rio_cm.c"
},
"signature_type": "Function",
"digest": {
"length": 1008.0,
"function_hash": "107305411807121224461095496106014976104"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c03ddc183249f03fc7e057e02cae6f89144d0123",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38090-f6bdf35f",
"target": {
"file": "drivers/rapidio/rio_cm.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"136653990216961687938803460633353463921",
"188964775421901971752600843527731455307",
"153923915070995463870993729100289006897"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecf5ee280b702270afb02f61b299d3dfe3ec7730",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2025-38090-fe94d261",
"target": {
"function": "riocm_ch_send",
"file": "drivers/rapidio/rio_cm.c"
},
"signature_type": "Function",
"digest": {
"length": 1008.0,
"function_hash": "107305411807121224461095496106014976104"
}
}
]