EEPROM and OTP Size Modification Vulnerability in Linux Kernel for PCI1xxxx Devices

CVE-2025-38422

What is CVE-2025-38422?

The Linux kernel has a vulnerability affecting the lan743x network driver that involves the modification of EEPROM and OTP sizes for PCI1xxxx devices. The issue allows for adjusted maximum size definitions, preventing potential out-of-bounds read and write operations. This change ensures accurate EEPROM length returns based on device specifications, thus enhancing the stability and safety of data handling operations in affected drivers.

References