CVE-2025-38183: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-38183 Overview

CVE-2025-38183 is an out-of-bounds write vulnerability in the Linux kernel's lan743x network driver. The flaw resides in the lan743x_ptp_io_event_clock_get() function, which handles Precision Time Protocol (PTP) IO events for Microchip LAN743x Ethernet controllers. A mismatch between the validated channel bound (PCI11X1X_PTP_IO_MAX_CHANNELS = 8) and the actual array size (LAN743X_PTP_N_EXTTS = 4) allows writes past the ptp->extts[] buffer. The issue was detected using the Svace static analysis tool and affects mainline Linux kernel builds including 6.16-rc1 and 6.16-rc2, as well as Debian Linux 11.

Critical Impact
Local attackers with driver-adjacent access can trigger memory corruption in kernel space, potentially leading to privilege escalation or system compromise.

Affected Products

Linux Kernel (multiple stable branches, including 6.16-rc1 and 6.16-rc2)
Debian Linux 11
Systems using the Microchip LAN743x Ethernet driver with PTP IO enabled

Discovery Timeline

2025-07-04 - CVE-2025-38183 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38183

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in the Linux kernel's lan743x driver, which supports Microchip LAN743x PCIe Gigabit Ethernet controllers. The driver implements PTP (Precision Time Protocol) support for hardware timestamping of network events. The affected code path handles PTP IO event clock reads triggered by GPIO input events.

Callers validate the channel argument against PCI11X1X_PTP_IO_MAX_CHANNELS, which is defined as 8 and matches the PTP interrupt status register (PTP_INT_STS) specification. However, lan743x_ptp_io_event_clock_get() uses this same channel value as an index into the ptp->extts[] array, which is sized by LAN743X_PTP_N_EXTTS = 4. When channel values 4 through 7 are supplied, the function writes timestamp data past the end of the array.

The fix increases LAN743X_PTP_N_EXTTS to 8, aligning the array size with the driver's channel validation and enabling use of all supported GPIO inputs.

Root Cause

The root cause is a size mismatch between two constants used in the same code path. PCI11X1X_PTP_IO_MAX_CHANNELS bounds the accepted channel values, while LAN743X_PTP_N_EXTTS sizes the destination array. Because the two macros were not kept in sync, channel indices that pass validation still address memory outside the array.

Attack Vector

Exploitation requires local access with the ability to trigger PTP IO events on a system using the affected driver. The write occurs in kernel context, so successful exploitation corrupts adjacent kernel data structures. Because the overwritten bytes contain attacker-influenced timestamp values (ts.tv_sec, ts.tv_nsec), a local attacker with control over PTP hardware event generation could shape the overwrite for privilege escalation or denial of service. No verified proof-of-concept exploit is publicly available.

// Vulnerable pattern (described in prose - see kernel commit for actual code)
// Caller validates: if (channel >= PCI11X1X_PTP_IO_MAX_CHANNELS) return;   // bound = 8
// Callee writes:   extts = &ptp->extts[channel];                            // array size = 4
//                  extts->ts.tv_sec = sec;                                  // OOB write when channel >= 4

Detection Methods for CVE-2025-38183

Indicators of Compromise

Unexpected kernel oops, panic, or KASAN slab-out-of-bounds reports referencing lan743x_ptp_io_event_clock_get or ptp->extts.
Anomalous PTP timestamp values in userspace consumers reading from /dev/ptp* character devices.
System instability on hosts using LAN743x-based network adapters with PTP hardware timestamping enabled.

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface out-of-bounds writes during driver exercise.
Inventory kernel and driver versions across the fleet and cross-reference against the kernel.org stable commits that carry the fix.
Audit systems for LAN743x hardware via lspci and correlate with kernels lacking the patch.

Monitoring Recommendations

Ingest kernel logs (dmesg, journalctl -k) into a central telemetry pipeline and alert on lan743x warnings, oops signatures, or KASAN reports.
Track loaded kernel modules and driver versions across endpoints to identify hosts running unpatched lan743x builds.
Monitor for unauthorized local privilege escalation attempts on systems with vulnerable kernels.

How to Mitigate CVE-2025-38183

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable commits (41017bd6, 4da0d235, 66bba1fd, e353b085, e8d48201) or upgrade to a fixed kernel release from your distribution.
Debian 11 users should update to the kernel package announced in the Debian LTS advisory.
Restrict local access on systems running LAN743x hardware until a patched kernel is deployed.

Patch Information

The fix redefines LAN743X_PTP_N_EXTTS from 4 to 8 so the ptp->extts[] array matches the validated channel bound. Patches are available via Linux kernel stable commit 41017bd6, commit 4da0d235, commit 66bba1fd, commit e353b085, and commit e8d48201. Debian users should refer to the Debian LTS Announcement.

Workarounds

Unload the lan743x kernel module on systems that do not require the affected hardware: modprobe -r lan743x.
Blacklist the driver via /etc/modprobe.d/ on hosts where LAN743x is not in use.
Disable PTP hardware timestamping on affected interfaces where operationally feasible.

bash

# Verify running kernel and lan743x module status
uname -r
lsmod | grep lan743x

# Temporarily unload the driver (requires root and no active dependency)
sudo modprobe -r lan743x

# Persistently blacklist the driver until a patched kernel is installed
echo 'blacklist lan743x' | sudo tee /etc/modprobe.d/blacklist-lan743x.conf
sudo update-initramfs -u