CVE-2025-38332

scsi: lpfc: Use memcpy() for BIOS version

State: Published
Severity: Not scored
Published: Jul 10, 2025
Updated: Jun 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Use memcpy() for BIOS version

The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is passed in.

Anyway, instead of memset() with 0 followed by a strlcat(), just use memcpy() and ensure that the resulting buffer is NULL terminated.

BIOSVersion is only used for the lpfc_printf_log() which expects a properly terminated string.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b3b4f3e1d575fe142fd437158425c2359b695ff1 to before ac7bfaa099ec3e4d7dfd0ab9726fc3bc7911365dAffected b3b4f3e1d575fe142fd437158425c2359b695ff1 to before b699bda5db818b684ff62d140defd6394f38f3d6Affected b3b4f3e1d575fe142fd437158425c2359b695ff1 to before d34f2384d6df11a6c67039b612c2437f46e587e8Affected b3b4f3e1d575fe142fd437158425c2359b695ff1 to before 75ea8375c5a83f46c47bfb3de6217c7589a8df93Affected b3b4f3e1d575fe142fd437158425c2359b695ff1 to before 34c0a670556b24d36c9f8934227edb819ca5609eAffected b3b4f3e1d575fe142fd437158425c2359b695ff1 to before 2f63bf0d2b146956a2f2ff3b25cee71019e64561Affected b3b4f3e1d575fe142fd437158425c2359b695ff1 to before 003baa7a1a152576d744bd655820449bbdb0248eAffected b3b4f3e1d575fe142fd437158425c2359b695ff1 to before ae82eaf4aeea060bb736c3e20c0568b67c701d7dAffected
LinuxLinux	5.2Affected before 5.2Not affected 5.4.295 through 5.4.Not affected 5.10.239 through 5.10.Not affected 5.15.186 through 5.15.Not affected 6.1.142 through 6.1.Not affected 6.6.95 through 6.6.Not affected 6.12.35 through 6.12.Not affected 6.15.4 through 6.15.*Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

b3b4f3e1d575fe142fd437158425c2359b695ff1 to before ac7bfaa099ec3e4d7dfd0ab9726fc3bc7911365dAffected
b3b4f3e1d575fe142fd437158425c2359b695ff1 to before b699bda5db818b684ff62d140defd6394f38f3d6Affected
b3b4f3e1d575fe142fd437158425c2359b695ff1 to before d34f2384d6df11a6c67039b612c2437f46e587e8Affected
b3b4f3e1d575fe142fd437158425c2359b695ff1 to before 75ea8375c5a83f46c47bfb3de6217c7589a8df93Affected
b3b4f3e1d575fe142fd437158425c2359b695ff1 to before 34c0a670556b24d36c9f8934227edb819ca5609eAffected
b3b4f3e1d575fe142fd437158425c2359b695ff1 to before 2f63bf0d2b146956a2f2ff3b25cee71019e64561Affected
b3b4f3e1d575fe142fd437158425c2359b695ff1 to before 003baa7a1a152576d744bd655820449bbdb0248eAffected
b3b4f3e1d575fe142fd437158425c2359b695ff1 to before ae82eaf4aeea060bb736c3e20c0568b67c701d7dAffected

LinuxLinux

5.2Affected
before 5.2Not affected
5.4.295 through 5.4.*Not affected
5.10.239 through 5.10.*Not affected
5.15.186 through 5.15.*Not affected
6.1.142 through 6.1.*Not affected
6.6.95 through 6.6.*Not affected
6.12.35 through 6.12.*Not affected
6.15.4 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.