CVE-2025-38336

What it actually does

The pata_via driver allows ATAPI DMA transfers on VT6415/VT6330 controllers, triggering an unhandled hardware condition that hard-hangs the system with no log output.

Why it matters to the business

Systems using VIA IDE controllers with optical drives can experience sudden unrecoverable hangs during normal media operations, leading to downtime and potential boot failures until the controller is reset or the kernel is updated.

How an attack unfolds

An attacker with local access or the ability to insert optical media can issue ATAPI commands that initiate DMA transfers; the controller bug causes an immediate system hang without any kernel trace or opportunity for recovery.

How to fix it

Update to a fixed kernel containing commit 67d66a5e4583fd3bcf13d6f747e571df13cbad51 or later; for Alpaquita linux-lts use versions 6.6.58-r0 or 6.12.41-r0. The driver now forces PIO mode for all ATAPI devices on the affected controllers.

How to confirm the fix worked

Confirm the running kernel contains the cited commit or package version; verify that ATAPI devices on VIA controllers are now forced to PIO via driver logs or by reproducing the original cdrecord ATIP command without a hang.

Typical attack path

1. Attach an ATAPI optical device to a VT6415 or VT6330 controller
2. Initiate DMA-capable commands such as reading ATIP or burning media
3. Controller enters unrecoverable state and halts the entire system

How to detect it

Review kernel boot and dmesg logs for ATA controller initialization messages referencing VT6415 or VT6330; look for sudden system halts during ATAPI operations with no preceding error entries.

What your security team should do

• Prioritize patching all systems with VIA VT6415/VT6330 controllers that host optical drives
• Apply the fixed kernel packages immediately on affected distributions
• After update, test optical media workflows to confirm PIO fallback is active