In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is… (CVE-2025-38332)
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is passed in. Anyway, instead of memset() with 0 followed by a strlcat(), just use memcpy() and ensure that the resulting buffer is NULL terminated. BIOSVersion is only used for the lpfc_printf_log() which expects a properly terminated string.
AI Analysis
Technical Summary
This advisory covers two security fixes in the Linux kernel packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support. CVE-2025-38332 addresses a flaw in the SCSI lpfc driver related to BIOS version handling by switching to memcpy(), mitigating a potential issue. CVE-2025-38352 resolves a race condition between handle_posix_cpu_timers() and posix_cpu_timer_del() functions, which could lead to unpredictable behavior. Red Hat has released updated kernel packages to remediate these vulnerabilities and requires a reboot to apply the fixes.
Potential Impact
The vulnerabilities affect the Linux kernel core components, potentially impacting system stability and security. The advisory rates the security impact as Important (high severity). No known exploits in the wild have been reported. The issues could allow for unintended behavior or race conditions in kernel operations related to SCSI BIOS version handling and POSIX CPU timers.
Mitigation Recommendations
Red Hat has released updated kernel packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support to address these vulnerabilities. Users should apply the provided kernel updates as detailed in the Red Hat advisory and reboot their systems to ensure the fixes take effect. Patch status is confirmed with an official fix available.
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is… (CVE-2025-38332)
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is passed in. Anyway, instead of memset() with 0 followed by a strlcat(), just use memcpy() and ensure that the resulting buffer is NULL terminated. BIOSVersion is only used for the lpfc_printf_log() which expects a properly terminated string.
CVSS v3.1
Score 5.5medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers two security fixes in the Linux kernel packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support. CVE-2025-38332 addresses a flaw in the SCSI lpfc driver related to BIOS version handling by switching to memcpy(), mitigating a potential issue. CVE-2025-38352 resolves a race condition between handle_posix_cpu_timers() and posix_cpu_timer_del() functions, which could lead to unpredictable behavior. Red Hat has released updated kernel packages to remediate these vulnerabilities and requires a reboot to apply the fixes.
Potential Impact
The vulnerabilities affect the Linux kernel core components, potentially impacting system stability and security. The advisory rates the security impact as Important (high severity). No known exploits in the wild have been reported. The issues could allow for unintended behavior or race conditions in kernel operations related to SCSI BIOS version handling and POSIX CPU timers.
Mitigation Recommendations
Red Hat has released updated kernel packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support to address these vulnerabilities. Users should apply the provided kernel updates as detailed in the Red Hat advisory and reboot their systems to ensure the fixes take effect. Patch status is confirmed with an official fix available.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:15648
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-38352"]
Threat ID: 6a3da1e44853345fc182cfbd
Added to database: 06/25/2026, 21:47:16 UTC
Last enriched: 06/25/2026, 22:31:53 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 62
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.