CVE-2025-38398 is a vulnerability in the Linux kernel's spi-qpic-snand driver related to improper memory allocation for BAM transactions. The driver initially allocates memory for only one 'codeword' during probe, but the actual number of codewords depends on the NAND chip's page size and is unknown at that time. This leads to out-of-bounds memory access when the number of required transactions exceeds the allocated size, causing memory corruption. Symptoms include swiotlb mapping failures, kernel panics due to NULL pointer dereference, and spinlock corruption on reboot. The issue is resolved by freeing the initially allocated memory and reallocating it once the actual number of codewords is known.