CVE-2025-38456

ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()

Description

In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() The "intf" list iterator is an invalid pointer if the correct "intf->intf_num" is not found. Calling atomic_dec(&intf->nr_users) on and invalid pointer will lead to memory corruption. We don't really need to call atomic_dec() if we haven't called atomic_add_return() so update the if (intf->in_shutdown) path as well.

N/A

CVSS

Severity:

EPSS 0.02%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/cbc1670297f675854e982d23c8583900ff0cc67a
https://git.kernel.org/stable/c/e2d5c005dfc96fe857676d1d8ac46b29275cb89b
https://git.kernel.org/stable/c/9e0d33e75c1604c3fad5586ad4dfa3b2695a3950
https://git.kernel.org/stable/c/7c1a6ddb99858e7d68961f74ae27caeeeca67b6a
https://git.kernel.org/stable/c/fa332f5dc6fc662ad7d3200048772c96b861cf6b

Frequently Asked Questions

What is the severity of CVE-2025-38456?: CVE-2025-38456 has not yet been assigned a CVSS score.
How to fix CVE-2025-38456?: To fix CVE-2025-38456, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-38456 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2025-38456 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-38456?: CVE-2025-38456 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.