CVE-2025-38197

What it actually does

Incorrect list head passed to list_for_each_entry*() in dell_rbu causes sysfs reads of packet data to start at the wrong entry and list clearing to trigger NULL pointer dereference.

Why it matters to the business

Systems using the affected Linux kernel driver risk kernel crashes or exposure of incorrect data when reading or clearing BIOS update packets via sysfs; prevalence in container and embedded Linux deployments increases operational risk.

How an attack unfolds

An attacker with local access interacts with the dell_rbu sysfs interface to trigger list traversal from the wrong head, either reading unintended packet contents or forcing a NULL dereference during list clearing operations.

How to fix it

Update to Linux kernel commit 5e8c658acd1b7c186aeffa46bf08795e121f401a or later; Chainguard users should upgrade affected cert-manager-fips packages to 1.17.2-r2 or newer.

How to confirm the fix worked

Confirm kernel source contains the corrected list head argument in dell_rbu list traversal loops and test sysfs read/clear paths on updated systems.

Typical attack path

1. Identify host with dell_rbu driver loaded
2. Access /sys filesystem entries exposed by the driver
3. Read packet data or issue clear operation to trigger incorrect list walk
4. Observe incorrect data returned or kernel oops/NULL dereference

How to detect it

Review kernel logs for NULL pointer dereference oops involving dell_rbu list operations and audit sysfs access to dell_rbu packet entries.

What your security team should do

• Prioritize kernel updates on Dell systems exposing dell_rbu sysfs interfaces
• Monitor EPSS trend and reassess if exploitation maturity increases
• Restrict unprivileged access to dell_rbu sysfs nodes until patched