Junglewise Threat Intelligence

CVE-2025-38676: Linux Kernel stack buffer overflow in AMD IOMMU driver

CVE-2025-38676 · Severity: high · CVSS 7.8 · Published 2025-08-26

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's AMD IOMMU driver could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when the system processes specific startup instructions (kernel command line parameters) related to hardware identification. While these instructions are typically controlled by system administrators, an exploit could compromise the integrity and availability of the operating system.

Technical details

A stack-based buffer overflow exists in the 'parse_ivrs_acpihid' function within 'drivers/iommu/amd/init.c'. The vulnerability is caused by an off-by-one error where the code could write one byte past the end of the 'acpiid' buffer if the input string from the kernel command line is at its maximum allowed length. An attacker with the ability to modify kernel boot parameters could exploit this to overwrite adjacent stack memory, potentially leading to local privilege escalation or a denial-of-service (system crash). The fix involves increasing the buffer size to accommodate the NULL terminator and correcting the length check logic. Patches have been released for multiple stable kernel branches including 5.10, 5.15, 6.1, 6.6, 6.12, and 6.16.

Affected products

  • Linux Linux Kernel 5.4.237 to 5.5, 5.10.175 to 5.10.241, 5.15.103 to 5.15.190, 6.1.16 to 6.1.149, 6.2.3 to 6.6.103, 6.7 to 6.12.44, 6.13 to 6.16.4

Timeline

  • 2025-08-04: other: Patch authored by Kees Cook
  • 2025-08-26: disclosed: CVE published by kernel.org
  • 2025-08-28: patched: Patches committed to stable trees

References

Related threats