CVE-2025-38497

What it actually does

Out-of-bounds read in Linux kernel configfs USB gadget store functions when an empty string is written to qw_sign or landingPage sysfs attributes, caused by accessing page[l-1] without first checking that length l exceeds zero.

Why it matters to the business

Potential kernel memory disclosure or crash on systems exposing USB gadget configfs interfaces, increasing operational risk for devices handling USB gadget configurations; low exploitation likelihood but requires prompt patching on affected Debian chromium packages.

How an attack unfolds

An attacker with write access to the affected sysfs attributes writes an empty string, triggering the unchecked length access and resulting in an out-of-bounds read; no widespread exploitation observed despite mentions of related privilege-escalation campaigns targeting other kernel flaws.

How to fix it

Upgrade chromium on Debian 12 to version 139.0.7258.66-1~deb12u1 or later; apply the upstream kernel patch adding early zero-length checks in os_desc_qw_sign_store and webusb_landingPage_store.

How to confirm the fix worked

Confirm the fixed chromium package version is installed and test that writing empty strings to the attributes no longer triggers the access; review kernel logs for prior OOB-related warnings.

Typical attack path

1. Obtain write access to usb gadget configfs sysfs attributes
2. Write a zero-length string to qw_sign or landingPage
3. Trigger the store function to perform the unchecked page access
4. Observe resulting memory read or kernel instability

How to detect it

Search kernel logs and audit trails for unexpected writes to configfs USB gadget attributes combined with oops or memory access warnings; no specific known exploitation artifacts reported.

What your security team should do

• Prioritize patching affected Debian chromium installations to the listed fixed version
• Monitor EPSS trend for any increase in exploit probability
• Audit systems exposing USB gadget configfs interfaces for unnecessary exposure