CVE-2025-38277
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
mtd: nand: ecc-mxic: Fix use of uninitialized variable ret
If ctx->steps is zero, the loop processing ECC steps is skipped, and the variable ret remains uninitialized. It is later checked and returned, which leads to undefined behavior and may cause unpredictable results in user space or kernel crashes.
This scenario can be triggered in edge cases such as misconfigured geometry, ECC engine misuse, or if ctx->steps is not validated after initialization.
Initialize ret to zero before the loop to ensure correct and safe behavior regardless of the ctx->steps value.
Leer descripción completaMostrar menos
Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.18%
- Percentil entre todas las CVEs puntuadas: 7
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-908
Referencias
- https://git.kernel.org/stable/c/49482f4a39620f6afedcd3f6aa9e0d558b6a460b
- https://git.kernel.org/stable/c/4d9d6e4be09472aa72953caca3dbefdc27846170
- https://git.kernel.org/stable/c/7a23cc510ecaabab4f6df7e9d910d16e279b72ad
- https://git.kernel.org/stable/c/a0d9d9b5a4634e146ae41cb25667322e5c7d74d2
- https://git.kernel.org/stable/c/d95846350aac72303036a70c4cdc69ae314aa26d
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-38277",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "48e6633a9fa2400b53a964358753769f291a7eb0",
"lessThan": "4d9d6e4be09472aa72953caca3dbefdc27846170",
"versionType": "git"
},
{
"status": "affected",
"version": "48e6633a9fa2400b53a964358753769f291a7eb0",
"lessThan": "a0d9d9b5a4634e146ae41cb25667322e5c7d74d2",
"versionType": "git"
},
{
"status": "affected",
"version": "48e6633a9fa2400b53a964358753769f291a7eb0",
"lessThan": "7a23cc510ecaabab4f6df7e9d910d16e279b72ad",
"versionType": "git"
},
{
"status": "affected",
"version": "48e6633a9fa2400b53a964358753769f291a7eb0",
"lessThan": "49482f4a39620f6afedcd3f6aa9e0d558b6a460b",
"versionType": "git"
},
{
"status": "affected",
"version": "48e6633a9fa2400b53a964358753769f291a7eb0",
"lessThan": "d95846350aac72303036a70c4cdc69ae314aa26d",
"versionType": "git"
}
],
"programFiles": [
"drivers/mtd/nand/ecc-mxic.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.142",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.94",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.34",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.15.3",
"versionType": "semver",
"lessThanOrEqual": "6.15.*"
},
{
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/mtd/nand/ecc-mxic.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-07-10T08:15:26.003",
"references": [
{
"url": "https://git.kernel.org/stable/c/49482f4a39620f6afedcd3f6aa9e0d558b6a460b",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4d9d6e4be09472aa72953caca3dbefdc27846170",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7a23cc510ecaabab4f6df7e9d910d16e279b72ad",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a0d9d9b5a4634e146ae41cb25667322e5c7d74d2",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d95846350aac72303036a70c4cdc69ae314aa26d",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-908"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: nand: ecc-mxic: Fix use of uninitialized variable ret\n\nIf ctx->steps is zero, the loop processing ECC steps is skipped,\nand the variable ret remains uninitialized. It is later checked\nand returned, which leads to undefined behavior and may cause\nunpredictable results in user space or kernel crashes.\n\nThis scenario can be triggered in edge cases such as misconfigured\ngeometry, ECC engine misuse, or if ctx->steps is not validated\nafter initialization.\n\nInitialize ret to zero before the loop to ensure correct and safe\nbehavior regardless of the ctx->steps value.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mtd: nand: ecc-mxic: Se corrige el uso de la variable ret sin inicializar. Si ctx->steps es cero, se omite el procesamiento del bucle de pasos ECC y la variable ret permanece sin inicializar. Posteriormente, se verifica y se devuelve, lo que genera un comportamiento indefinido y puede causar resultados impredecibles en el espacio de usuario o fallos del kernel. Este escenario puede activarse en casos extremos, como una geometría mal configurada, un uso indebido del motor ECC o si ctx->steps no se valida tras la inicialización. Inicialice ret a cero antes del bucle para garantizar un comportamiento correcto y seguro, independientemente del valor de ctx->steps. Encontrado por el Centro de Verificación de Linux (linuxtesting.org) con SVACE."
}
],
"lastModified": "2026-06-17T09:16:32.070",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2B63426-2491-4514-8AE4-140C36735490",
"versionEndExcluding": "6.1.142",
"versionStartIncluding": "5.18"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "304E3F01-7D7A-4908-994E-7F95C5C00B06",
"versionEndExcluding": "6.6.94",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4FFA54AA-CDFE-4591-BD07-72813D0948F4",
"versionEndExcluding": "6.12.34",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0541C761-BD5E-4C1A-8432-83B375D7EB92",
"versionEndExcluding": "6.15.3",
"versionStartIncluding": "6.13"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}