Riskcovery

CVE-2025-38422

net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices

State
Published
Severity
7.8 High
Published
Jul 25, 2025
Updated
Aug 5, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices

Maximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb and 64 Kb respectively. Adjust max size definitions and return correct EEPROM length based on device. Also prevent out-of-bound read/write.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 695846047aa9b4bb387473a9fd227a51ae7de5e9 to before 6b4201d74d0a49af2123abf2c9d142e59566714bAffected
  • 695846047aa9b4bb387473a9fd227a51ae7de5e9 to before 088279ff18cdc437d6fac5890e0c52c624f78a5bAffected
  • 695846047aa9b4bb387473a9fd227a51ae7de5e9 to before 51318d644c993b3f7a60b8616a6a5adc1e967cd2Affected
  • 695846047aa9b4bb387473a9fd227a51ae7de5e9 to before 9c41d2a2aa3817946eb613522200cab55513ddaaAffected
  • 695846047aa9b4bb387473a9fd227a51ae7de5e9 to before 3b9935586a9b54d2da27901b830d3cf46ad66a1eAffected
LinuxLinux
  • 4.19Affected
  • before 4.19Not affected
  • 6.1.142 through 6.1.*Not affected
  • 6.6.95 through 6.6.*Not affected
  • 6.12.35 through 6.12.*Not affected
  • 6.15.4 through 6.15.*Not affected
  • 6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.