In the Linux kernel, the following vulnerability has been resolved:
dmaengine: nbpfaxi: Fix memory corruption in probe()
The nbpf->chan[] array is allocated earlier in the nbpfprobe() function and it has "numchannels" elements. These three loops iterate one element farther than they should and corrupt memory.
The changes to the second loop are more involved. In this case, we're copying data from the irqbuf[] array into the nbpf->chan[] array. If the data in irqbuf[i] is the error IRQ then we skip it, so the iterators are not in sync. I added a check to ensure that we don't go beyond the end of the irqbuf[] array. I'm pretty sure this can't happen, but it seemed harmless to add a check.
On the other hand, after the loop has ended there is a check to ensure that the "chan" iterator is where we expect it to be. In the original code we went one element beyond the end of the array so the iterator wasn't in the correct place and it would always return -EINVAL. However, now it will always be in the correct place. I deleted the check since we know the result.
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"206687159361723372633261648267821706702",
"79617787162244265178050950759908565420",
"60324762149543212196704548046846292784",
"286261265123150972474136355030326499667",
"203951052525268005953437399140494932206",
"165197721109565912815628424373331768531",
"9848050596913815084712382099812896508",
"63343402465392582456686633598773001383",
"206563520328792832230797196032448807531",
"165876923280094659429958018017380266136",
"196247511815146641957018039525950731867",
"220378654399701734598174606234236336492",
"66308017001439355732384883395446435954",
"204855864002304442660980287674140899611",
"177227934739392107134132186167327564900",
"328035396249897561627316197913926333260",
"51498776107067175469159875689653793765",
"210482470756227076230041406299417240015",
"2888771211811155498640183212211390430"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f366b36c5e3ce29c9a3c8eed3d1631908e4fc8bb",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/dma/nbpfaxi.c"
},
"id": "CVE-2025-38538-07f00cee",
"signature_type": "Line"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"206687159361723372633261648267821706702",
"79617787162244265178050950759908565420",
"60324762149543212196704548046846292784",
"286261265123150972474136355030326499667",
"203951052525268005953437399140494932206",
"165197721109565912815628424373331768531",
"9848050596913815084712382099812896508",
"63343402465392582456686633598773001383",
"206563520328792832230797196032448807531",
"165876923280094659429958018017380266136",
"196247511815146641957018039525950731867",
"220378654399701734598174606234236336492",
"66308017001439355732384883395446435954",
"204855864002304442660980287674140899611",
"177227934739392107134132186167327564900",
"328035396249897561627316197913926333260",
"51498776107067175469159875689653793765",
"210482470756227076230041406299417240015",
"2888771211811155498640183212211390430"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6bbd67ab5de37a74ac85c83c5a26664b62034dd",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/dma/nbpfaxi.c"
},
"id": "CVE-2025-38538-09e33b73",
"signature_type": "Line"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"206687159361723372633261648267821706702",
"79617787162244265178050950759908565420",
"60324762149543212196704548046846292784",
"286261265123150972474136355030326499667",
"203951052525268005953437399140494932206",
"165197721109565912815628424373331768531",
"9848050596913815084712382099812896508",
"63343402465392582456686633598773001383",
"206563520328792832230797196032448807531",
"165876923280094659429958018017380266136",
"196247511815146641957018039525950731867",
"220378654399701734598174606234236336492",
"66308017001439355732384883395446435954",
"204855864002304442660980287674140899611",
"177227934739392107134132186167327564900",
"328035396249897561627316197913926333260",
"51498776107067175469159875689653793765",
"210482470756227076230041406299417240015",
"2888771211811155498640183212211390430"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84fff8e6f11b9af1407e273995b5257d99ff0cff",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/dma/nbpfaxi.c"
},
"id": "CVE-2025-38538-3c4a39b8",
"signature_type": "Line"
},
{
"digest": {
"function_hash": "59439247698883876327817478465448484876",
"length": 3020.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@122160289adf8ebf15060f1cbf6265b55a914948",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/dma/nbpfaxi.c",
"function": "nbpf_probe"
},
"id": "CVE-2025-38538-3f8f1d74",
"signature_type": "Function"
},
{
"digest": {
"function_hash": "69525856958276576717385987789617347477",
"length": 3129.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aec396b4f736f3f8d2c28a9cd2924a4ada57ae87",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/dma/nbpfaxi.c",
"function": "nbpf_probe"
},
"id": "CVE-2025-38538-534d7db7",
"signature_type": "Function"
},
{
"digest": {
"function_hash": "69525856958276576717385987789617347477",
"length": 3129.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84fff8e6f11b9af1407e273995b5257d99ff0cff",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/dma/nbpfaxi.c",
"function": "nbpf_probe"
},
"id": "CVE-2025-38538-5be0aa97",
"signature_type": "Function"
},
{
"digest": {
"function_hash": "59439247698883876327817478465448484876",
"length": 3020.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bb016438335ec02b01f96bf1367378c2bfe03e5",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/dma/nbpfaxi.c",
"function": "nbpf_probe"
},
"id": "CVE-2025-38538-604a9e4c",
"signature_type": "Function"
},
{
"digest": {
"function_hash": "69525856958276576717385987789617347477",
"length": 3129.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24861ef8b517a309a4225f2793be0cd8fa0bec9e",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/dma/nbpfaxi.c",
"function": "nbpf_probe"
},
"id": "CVE-2025-38538-615615ac",
"signature_type": "Function"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"206687159361723372633261648267821706702",
"79617787162244265178050950759908565420",
"60324762149543212196704548046846292784",
"286261265123150972474136355030326499667",
"203951052525268005953437399140494932206",
"165197721109565912815628424373331768531",
"9848050596913815084712382099812896508",
"63343402465392582456686633598773001383",
"206563520328792832230797196032448807531",
"165876923280094659429958018017380266136",
"196247511815146641957018039525950731867",
"220378654399701734598174606234236336492",
"66308017001439355732384883395446435954",
"204855864002304442660980287674140899611",
"177227934739392107134132186167327564900",
"328035396249897561627316197913926333260",
"51498776107067175469159875689653793765",
"210482470756227076230041406299417240015",
"2888771211811155498640183212211390430"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bb016438335ec02b01f96bf1367378c2bfe03e5",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/dma/nbpfaxi.c"
},
"id": "CVE-2025-38538-87e6b642",
"signature_type": "Line"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"206687159361723372633261648267821706702",
"79617787162244265178050950759908565420",
"60324762149543212196704548046846292784",
"286261265123150972474136355030326499667",
"203951052525268005953437399140494932206",
"165197721109565912815628424373331768531",
"9848050596913815084712382099812896508",
"63343402465392582456686633598773001383",
"206563520328792832230797196032448807531",
"165876923280094659429958018017380266136",
"196247511815146641957018039525950731867",
"220378654399701734598174606234236336492",
"66308017001439355732384883395446435954",
"204855864002304442660980287674140899611",
"177227934739392107134132186167327564900",
"328035396249897561627316197913926333260",
"51498776107067175469159875689653793765",
"210482470756227076230041406299417240015",
"2888771211811155498640183212211390430"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24861ef8b517a309a4225f2793be0cd8fa0bec9e",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/dma/nbpfaxi.c"
},
"id": "CVE-2025-38538-96154d46",
"signature_type": "Line"
},
{
"digest": {
"function_hash": "59439247698883876327817478465448484876",
"length": 3020.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6bbd67ab5de37a74ac85c83c5a26664b62034dd",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/dma/nbpfaxi.c",
"function": "nbpf_probe"
},
"id": "CVE-2025-38538-9bacd4dd",
"signature_type": "Function"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"206687159361723372633261648267821706702",
"79617787162244265178050950759908565420",
"60324762149543212196704548046846292784",
"286261265123150972474136355030326499667",
"203951052525268005953437399140494932206",
"165197721109565912815628424373331768531",
"9848050596913815084712382099812896508",
"63343402465392582456686633598773001383",
"206563520328792832230797196032448807531",
"165876923280094659429958018017380266136",
"196247511815146641957018039525950731867",
"220378654399701734598174606234236336492",
"66308017001439355732384883395446435954",
"204855864002304442660980287674140899611",
"177227934739392107134132186167327564900",
"328035396249897561627316197913926333260",
"51498776107067175469159875689653793765",
"210482470756227076230041406299417240015",
"2888771211811155498640183212211390430"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@122160289adf8ebf15060f1cbf6265b55a914948",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/dma/nbpfaxi.c"
},
"id": "CVE-2025-38538-9d23738a",
"signature_type": "Line"
},
{
"digest": {
"function_hash": "59439247698883876327817478465448484876",
"length": 3020.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@188c6ba1dd925849c5d94885c8bbdeb0b3dcf510",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/dma/nbpfaxi.c",
"function": "nbpf_probe"
},
"id": "CVE-2025-38538-9db18317",
"signature_type": "Function"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"206687159361723372633261648267821706702",
"79617787162244265178050950759908565420",
"60324762149543212196704548046846292784",
"286261265123150972474136355030326499667",
"203951052525268005953437399140494932206",
"165197721109565912815628424373331768531",
"9848050596913815084712382099812896508",
"63343402465392582456686633598773001383",
"206563520328792832230797196032448807531",
"165876923280094659429958018017380266136",
"196247511815146641957018039525950731867",
"220378654399701734598174606234236336492",
"66308017001439355732384883395446435954",
"204855864002304442660980287674140899611",
"177227934739392107134132186167327564900",
"328035396249897561627316197913926333260",
"51498776107067175469159875689653793765",
"210482470756227076230041406299417240015",
"2888771211811155498640183212211390430"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@188c6ba1dd925849c5d94885c8bbdeb0b3dcf510",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/dma/nbpfaxi.c"
},
"id": "CVE-2025-38538-c0a1692b",
"signature_type": "Line"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"206687159361723372633261648267821706702",
"79617787162244265178050950759908565420",
"60324762149543212196704548046846292784",
"286261265123150972474136355030326499667",
"203951052525268005953437399140494932206",
"165197721109565912815628424373331768531",
"9848050596913815084712382099812896508",
"63343402465392582456686633598773001383",
"206563520328792832230797196032448807531",
"165876923280094659429958018017380266136",
"196247511815146641957018039525950731867",
"220378654399701734598174606234236336492",
"66308017001439355732384883395446435954",
"204855864002304442660980287674140899611",
"177227934739392107134132186167327564900",
"328035396249897561627316197913926333260",
"51498776107067175469159875689653793765",
"210482470756227076230041406299417240015",
"2888771211811155498640183212211390430"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aec396b4f736f3f8d2c28a9cd2924a4ada57ae87",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/dma/nbpfaxi.c"
},
"id": "CVE-2025-38538-c7491ea8",
"signature_type": "Line"
},
{
"digest": {
"function_hash": "73228040941889211089841770770882779416",
"length": 3082.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f366b36c5e3ce29c9a3c8eed3d1631908e4fc8bb",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/dma/nbpfaxi.c",
"function": "nbpf_probe"
},
"id": "CVE-2025-38538-ce78e70a",
"signature_type": "Function"
}
]