Buffer Overflow Vulnerability in Linux Kernel's SCSI lpfc Driver

CVE-2025-38332

What is CVE-2025-38332?

A vulnerability in the Linux kernel affects the SCSI lpfc driver, where incorrect usage of strlcat() may lead to a panic due to perceived buffer overflow risks. The original implementation involving memset() and strlcat() was replaced with memcpy() to ensure proper null termination of the resulting string. This change improves the reliability of the BIOSVersion string used in lpfc_printf_log().

References