CVE-2025-38348

What it actually does

Buffer overflow in p54_rx_eeprom_readback() via unchecked le16_to_cpu(eeprom->v{1,2}.len) supplied by a malicious USB device, allowing memcpy beyond the end of priv->eeprom.

Why it matters to the business

Kernel panic or crash on affected Linux systems when a malicious USB device is connected; low prevalence because the driver requires non-default proprietary firmware upload first.

How an attack unfolds

Attacker presents a USB device that emulates an Intersil p54 interface, causes the driver to upload firmware, then returns an eeprom_readback message containing a tampered oversized length field that triggers the out-of-bounds copy.

How to fix it

Upgrade linux-lts packages to the listed fixed versions (6.1.81-r0, 6.6.58-r0, 6.12.41-r0) or apply commit 12134f79e53eb56b0b0b7447fa0c512acf6a8422; disable the p54 driver if the hardware is not required.

How to confirm the fix worked

Confirm the running kernel contains the size check added to p54_rx_eeprom_readback and that the driver no longer trusts the length returned by the device; test by attempting connection with an emulated oversized response.

Typical attack path

1. Present malicious USB device that matches p54 VID/PID
2. Driver loads and uploads firmware
3. Device replies to eeprom read request with oversized len field
4. memcpy copies attacker-controlled data past priv->eeprom buffer
5. Kernel panic or memory corruption occurs

How to detect it

Search kernel logs and crash dumps for p54_rx_eeprom_readback symbols, buffer-overrun warnings, or sudden panics immediately after USB device enumeration; correlate with unexpected p54 firmware upload events.

What your security team should do

• Apply the kernel update immediately on any system exposing the p54 driver
• Blacklist the p54 module on endpoints that do not need the hardware
• Monitor kernel logs for p54-related oops or panic entries
• Restrict physical USB access for high-value systems