Memory Corruption Vulnerability in Linux Kernel's SPI NAND Driver by Qualcomm

CVE-2025-38398

What is CVE-2025-38398?

This vulnerability in the Qualcomm SPI NAND driver of the Linux kernel is caused by a flaw in memory allocation for BAM transactions, leading to potential memory corruption and system instability. When using the mtd_nandbiterrs module for testing, the driver may exhibit various failures, including issues with swiotlb mapping and kernel panics due to NULL pointer dereferences. The root cause of these failures is inadequate memory allocation for BAM transactions, which can result in accessing memory outside of allocated bounds, leading to unpredictable behavior. Proper memory management practices are recommended to mitigate the effects of this vulnerability.

References