CVE-2025-38533

net: libwx: fix the using of Rx buffer DMA

State: Published
Severity: 9.8 Critical
Published: Aug 16, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

net: libwx: fix the using of Rx buffer DMA

The wx_rx_buffer structure contained two DMA address fields: 'dma' and 'page_dma'. However, only 'page_dma' was actually initialized and used to program the Rx descriptor. But 'dma' was uninitialized and used in some paths.

This could lead to undefined behavior, including DMA errors or use-after-free, if the uninitialized 'dma' was used. Althrough such error has not yet occurred, it is worth fixing in the code.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3c47e8ae113a68da47987750d9896e325d0aeedd to before 027701180a7bcb64c42eab291133ef0c87b5b6c5Affected 3c47e8ae113a68da47987750d9896e325d0aeedd to before ba7c793f96c1c2b944bb6f423d7243f3afc30fe9Affected 3c47e8ae113a68da47987750d9896e325d0aeedd to before 05c37b574997892a40a0e9b9b88a481566b2367dAffected 3c47e8ae113a68da47987750d9896e325d0aeedd to before 5fd77cc6bd9b368431a815a780e407b7781bcca0Affected
LinuxLinux	6.3Affected before 6.3Not affected 6.6.100 through 6.6.Not affected 6.12.40 through 6.12.Not affected 6.15.8 through 6.15.*Not affected 6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.