Memory Corruption in Linux Kernel Affecting Firmware Handling

CVE-2025-38428

What is CVE-2025-38428?

A vulnerability in the Linux Kernel's ims-pcu component has been identified, where the variable len, derived from firmware input, is not adequately validated. This oversight can lead to memory corruption through improper handling in the memcpy function. If the len variable exceeds expected bounds, it poses a significant risk by potentially overwriting memory segments. Secure coding practices necessitate that all input, especially from firmware, be thoroughly checked to prevent such vulnerabilities.

References