CVE-2025-38342

Vulnerability

Description

In the Linux kernel, the function software_node_get_reference_args() in the software node subsystem had an incorrect out-of-bounds (OOB) check. The function retrieves the @index-th element from a reference property. The existing OOB check did not guarantee that the property value contained enough bytes for (index + 1) * sizeof(*ref), meaning a malformed property could trigger an OOB read [1].

Exploitation

To exploit this vulnerability, an attacker would need to be able to supply a specially crafted software node property to the kernel. This typically requires local access or the ability to load a misconfigured device tree or firmware description. No special privileges beyond that are necessary, as the flaw is in the kernel's parsing logic [1].

Impact

An out-of-bounds read can leak kernel memory or, in some cases, lead to a denial of service (system crash). The CVSS v3 score of 7.1 (High) reflects the potential for confidentiality impact and availability impact, though exploitation complexity is low [1].

Mitigation

The fix has been applied in the Linux kernel stable tree. Users should update to a kernel version that includes the commit correcting the OOB check. The Siemens advisory SSA-082556 lists affected products, including the SIMATIC S7-1500 CPU family and related ET 200 CPUs and SIPLUS variants, indicating these also require patching [1].