CVE-2025-38239: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-38239 Overview

CVE-2025-38239 is a Linux kernel vulnerability in the megaraid_sas SCSI driver. On systems with DRAM interleave enabled, the driver performs an out-of-bounds array access when allocating MSI-X interrupt vectors. The megasas_alloc_irq_vectors function references index -1 against the node_to_cpumask_map array, which UBSAN flags as an array-index-out-of-bounds condition. The flaw stems from improper validation of the NUMA node index [CWE-129]. Local, low-privilege attackers on affected hosts can trigger the condition, leading to memory corruption impacting confidentiality, integrity, and availability. The Linux kernel maintainers have merged fixes across multiple stable branches.

Critical Impact
Local exploitation of the megaraid_sas driver can corrupt kernel memory, enabling denial of service or privilege escalation on systems using MegaRAID SAS controllers with DRAM interleave enabled.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Linux Kernel 6.16-rc1, 6.16-rc2, 6.16-rc3
Debian Linux 11.0

Discovery Timeline

2025-07-09 - CVE-2025-38239 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38239

Vulnerability Analysis

The vulnerability resides in the megaraid_sas SCSI driver, specifically in megasas_alloc_irq_vectors. During probe on systems where DRAM interleave is enabled, the driver queries the NUMA node associated with a given CPU or PCI device. Under this configuration, the returned node value can be -1 (indicating no NUMA affinity). The driver then uses this value as an index into the cpumask *[1024] array defined in arch/x86/include/asm/topology.h, resulting in an out-of-bounds read.

UBSAN emits the following diagnostic during driver probe: UBSAN: array-index-out-of-bounds in ./arch/x86/include/asm/topology.h:72:28 index -1 is out of range for type 'cpumask *[1024]'. The out-of-bounds access occurs in early kernel context during PCI probe, corrupting adjacent kernel memory or causing driver initialization to fail.

Root Cause

The root cause is missing validation of the node index returned by the topology helper before it is used as an array subscript. When DRAM interleave disables per-node CPU affinity, the helper returns NUMA_NO_NODE (-1), which the driver treats as a valid array index. This constitutes an improper validation of array index [CWE-129].

Attack Vector

Exploitation requires local access with low privileges on a host running an affected kernel with a MegaRAID SAS controller and DRAM interleave enabled. The condition triggers automatically at driver initialization, but an attacker with kernel module load capability or the ability to force driver rebinding can invoke the vulnerable code path. Successful exploitation may enable memory corruption in kernel space, denial of service, or privilege escalation depending on adjacent memory layout.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-38239

Indicators of Compromise

Kernel log entries containing UBSAN: array-index-out-of-bounds referencing arch/x86/include/asm/topology.h
Stack traces including megasas_alloc_irq_vectors and megasas_probe_one from the megaraid_sas module
Unexpected driver probe failures for megaraid_sas devices on NUMA-interleaved hosts
Kernel panics or system instability shortly after megaraid_sas module load

Detection Strategies

Query installed kernel versions against the fixed commits (074efb35, 19a47c96, 752eb816, bf2c1643, f1064b35) to identify unpatched hosts.
Monitor dmesg and /var/log/kern.log for UBSAN warnings originating from the megaraid_sas driver.
Inventory hosts running MegaRAID SAS controllers with DRAM interleave enabled in BIOS/UEFI, which represent the exposed configuration.

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and alert on UBSAN and kernel oops events referencing megaraid_sas.
Track kernel package versions across the fleet and flag systems still on vulnerable stable branches.
Monitor for anomalous kernel module load events and unexpected driver rebind operations on production servers.

How to Mitigate CVE-2025-38239

Immediate Actions Required

Apply the upstream kernel patches identified by commits 074efb35, 19a47c96, 752eb816, bf2c1643, and f1064b35, or upgrade to a distribution kernel that includes these fixes.
Debian 11 users should install the update announced in the Debian LTS Announcement.
Restrict local access and kernel module loading privileges to trusted administrators.
Audit fleet hosts for the presence of MegaRAID SAS controllers combined with DRAM interleave configurations.

Patch Information

The Linux kernel maintainers fixed the issue by validating the NUMA node index in megasas_alloc_irq_vectors before using it as an array subscript. The fix is available across multiple stable branches in the following commits: 074efb35, 19a47c96, 752eb816, bf2c1643, and f1064b35.

Workarounds

Disable DRAM interleave in system firmware to avoid the code path that returns NUMA_NO_NODE during driver probe.
Blocklist the megaraid_sas module on hosts that do not require the controller by adding it to /etc/modprobe.d/.
Limit local shell access and constrain use of finit_module and related module-loading syscalls through Linux capabilities or seccomp policies.

bash

# Blocklist the megaraid_sas module until the kernel is patched
echo "blacklist megaraid_sas" | sudo tee /etc/modprobe.d/blacklist-megaraid_sas.conf
sudo update-initramfs -u

# Verify the running kernel version against patched stable releases
uname -r