CVE-2025-38416
NFC: nci: uart: Set tty->disc_data only in success path
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel, the following vulnerability has been resolved: NFC: nci: uart: Set tty->disc_data only in success path Setting tty->disc_data before opening the NCI device means we need to
clean it up on error paths. This also opens some short window if device
starts sending data, even before NCIUARTSETDRIVER IOCTL succeeded
(broken hardware?). Close the window by exposing tty->disc_data only on
the success path, when opening of the NCI device and try_module_get()
succeeds. The code differs in error path in one aspect: tty->disc_data won't be
ever assigned thus NULL-ified. This however should not be relevant
difference, because of "tty->disc_data=NULL" in nci_uart_tty_open().
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: NFC: nci: uart: Establecer tty->disc_data solo en la ruta correcta. Configurar tty->disc_data antes de abrir el dispositivo NCI implica la necesidad de eliminar las rutas de error. Esto también genera una pequeña ventana de tiempo si el dispositivo comienza a enviar datos, incluso antes de que NCIUARTSETDRIVER IOCTL se haya ejecutado correctamente (¿hardware dañado?). Esta ventana se cierra exponiendo tty->disc_data solo en la ruta correcta cuando se abre el dispositivo NCI y try_module_get() se ejecuta correctamente. El código difiere en la ruta de error en un aspecto: tty->disc_data nunca se asignará, por lo que se convierte en NULL. Sin embargo, esta diferencia no debería ser relevante, debido a "tty->disc_data=NULL" en nci_uart_tty_open().
This update provides the initial livepatch for this kernel update. This update does not contain any fixes and will be updated with livepatches later.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2025-04-16 CVE Reserved
- 2025-07-25 CVE Published
- 2025-07-28 CVE Updated
- 2025-08-26 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| https://git.kernel.org/stable/c/9961127d4bce6325e9a0b0fb105e0c85a6c62cb7 | Vuln. Introduced |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.2 < 5.4.295 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.2 < 5.4.295" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.2 < 5.10.239 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.2 < 5.10.239" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.2 < 5.15.186 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.2 < 5.15.186" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.2 < 6.1.142 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.2 < 6.1.142" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.2 < 6.6.95 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.2 < 6.6.95" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.2 < 6.12.35 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.2 < 6.12.35" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.2 < 6.15.4 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.2 < 6.15.4" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.2 < 6.16 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.2 < 6.16" | en |
Affected
| ||||||