CVE-2025-38366

HighCVSS 7.8/10Last modified Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Check validity of "num_cpu" from user space

The maximum supported cpu number is EIOINTC_ROUTE_MAX_VCPUS about irqchip EIOINTC, here add validation about cpu number to avoid array pointer overflow.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
LinuxLinux>= 1ad7efa552fd5cf4e8c49fea863c5c6a5dcf9f00, < a3293b4078ee93174f70f36d3ab7618554ce6ab6; >= 1ad7efa552fd5cf4e8c49fea863c5c6a5dcf9f00, < cc8d5b209e09d3b52bca1ffe00045876842d96ae
LinuxLinux6.13

References

Timeline

Published
Jul 25, 2025
Last modified
Jul 30, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-383677.8In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Avoid overflow with array index The variable index is CVE-2025-383685.5In the Linux kernel, the following vulnerability has been resolved: misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() TheCVE-2025-383697.8In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Check availability of workqueue allocated by idxd wq dCVE-2025-38376.1An improper input validation vulnerability is identified in the End of Life (EOL) OVA based connect component which is deployed for installaCVE-2025-383705.5In the Linux kernel, the following vulnerability has been resolved: btrfs: fix failure to rebuild free space tree using multiple transactioCVE-2025-383715.5In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Disable interrupts before resetting the GPU Currently, an intCVE-2025-383725.5In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling __xa_storCVE-2025-383735.5In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix potential deadlock in MR deregistration The issue arises CVE-2025-383745.5In the Linux kernel, the following vulnerability has been resolved: optee: ffa: fix sleep in atomic context The OP-TEE driver registers thCVE-2025-383757.8In the Linux kernel, the following vulnerability has been resolved: virtio-net: ensure the received length does not exceed allocated size CVE-2025-383765.5In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: udc: disconnect/reconnect from host when do suspend/resuCVE-2025-383777.8In the Linux kernel, the following vulnerability has been resolved: rose: fix dangling neighbour pointers in rose_rt_device_down() There a
CVE-2025-38366: High severity, CVSS 7.8 | Vulnix