CVE-2025-38342

What it actually does

Incorrect bounds check in software_node_get_reference_args() allows an attacker-supplied property value to pass validation even when it lacks sufficient bytes for the requested index, enabling out-of-bounds memory access and corruption.

Why it matters to the business

Local users on affected Linux kernel deployments can trigger memory corruption that may lead to information disclosure or denial of service, increasing risk on servers, containers, and embedded devices that run unpatched kernels.

How an attack unfolds

An attacker with local access crafts a malformed software node property, invokes the vulnerable reference lookup path, bypasses the faulty size check, and reads or writes beyond allocated memory, potentially escalating privileges or crashing the system; observed in broader Linux kernel privilege-escalation campaigns.

How to fix it

Upgrade linux-lts packages to the listed fixed versions: 6.6.58-r0, 6.1.89-r0, 6.12.41-r0 or apply the commit 142acd739eb6f08c148a96ae8309256f1422ff4b from the stable git tree; rebuild and reboot all affected systems.

How to confirm the fix worked

Confirm the running kernel contains the corrected OOB check '((index + 1) * sizeof(*ref) > prop->length)' by inspecting the source or running a kernel version string that matches one of the fixed releases; test with crafted property inputs in a lab environment.

Typical attack path

1. Obtain local user or container access on a vulnerable kernel
2. Create or manipulate a software node with a property whose length is smaller than (index + 1) * sizeof(struct fwnode_reference_args)
3. Trigger software_node_get_reference_args() via device-tree or ACPI-related code paths
4. Perform out-of-bounds read or write to leak kernel data or corrupt memory structures
5. Leverage corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for unexpected oops or page-fault messages near software_node_get_reference_args; look for processes that suddenly access software-node properties with unusual index values; correlate with local user activity or container escapes in the days after publication.

What your security team should do

• Immediately schedule kernel upgrades to the fixed versions on all production systems
• Prioritize systems exposed to untrusted local users or containers
• Monitor EPSS trend and any new threat-actor reporting for this class of kernel reference-handling flaws
• Apply defense-in-depth: restrict local user namespaces and device-tree access where feasible