Threats tagged 'ghsa-f3fm-xfjv-xm82'

CVE-2025-38224 is a high-severity vulnerability in the Linux kernel's kvaser_pciefd CAN driver. The flaw involves improper handling of the echo_skb_max value, which defines the size of an echo_skb[] array. The driver rounds echo_skb_max up to the nearest power of two, causing tx/ack indices to potentially exceed the array boundary, leading to out-of-bounds memory access detected by KASAN. This can result in a kernel slab-out-of-bounds read, impacting system stability and potentially causing denial of service. The issue was identified by the Linux Verification Center using Syzkaller. No affected versions or patch information are explicitly stated in the input data. The CVSS v3.1 score is 7.1, indicating high severity.