CVE-2025-38676: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-38676 Overview

CVE-2025-38676 is a stack buffer overflow vulnerability in the Linux kernel's AMD IOMMU (Input-Output Memory Management Unit) driver. The flaw resides in the kernel command line parsing logic, where the driver writes one byte past the end of the acpiid stack buffer when the str argument reaches its maximum length. The issue is classified as an out-of-bounds write [CWE-787]. Affected products include the mainline Linux kernel (including 6.17-rc1 and 6.17-rc2) and Debian Linux 11. Siemens has also issued advisory SSA-032379 covering downstream industrial products.

Critical Impact
A local actor with the ability to influence kernel boot parameters can trigger a single-byte stack overflow in the AMD IOMMU driver, potentially compromising kernel memory integrity.

Affected Products

Linux Kernel (multiple versions, including 6.17-rc1 and 6.17-rc2)
Debian Linux 11
Siemens industrial products referenced in Siemens Security Advisory SSA-032379

Discovery Timeline

2025-08-26 - CVE-2025-38676 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38676

Vulnerability Analysis

The vulnerability exists in the AMD IOMMU driver (drivers/iommu/amd/) within the kernel command line option parser. When processing the ivrs_acpihid (or related) command line argument, the parser copies user-supplied string data into a fixed-size stack buffer named acpiid. If the str argument reaches the maximum expected length, the code writes one byte beyond the buffer boundary. This off-by-one write corrupts adjacent stack memory. While the kernel command line is generally considered a trusted input source, this remains a memory safety defect that must be corrected under the kernel's defensive coding standards.

Root Cause

The root cause is an off-by-one boundary check in the string handling logic. The parser does not correctly account for the terminating position of the destination buffer relative to the maximum accepted input length. The fix, applied across multiple stable kernel branches, adjusts the length calculation so writes remain within acpiid.

Attack Vector

Exploitation requires local access with the privilege to modify kernel boot parameters, typically through bootloader configuration files such as /etc/default/grub or by supplying arguments at boot time. An actor able to alter the kernel command line can craft a maximum-length ivrs_acpihid argument to trigger the one-byte stack write. The overflow occurs during early boot within the IOMMU initialization path.

No public proof-of-concept or exploitation-in-the-wild has been reported. Because the write is limited to a single byte on the stack, practical exploitation is constrained but may still enable stack corruption on kernels without stack protector coverage in the affected function. See Linux Kernel Commit 736db11c86f0 for the corrective patch.

Detection Methods for CVE-2025-38676

Indicators of Compromise

Unexpected modifications to bootloader configuration files such as /boot/grub/grub.cfg, /etc/default/grub, or /boot/loader/entries/*.conf.
Kernel oops or stack corruption messages during boot referencing the AMD IOMMU initialization path.
Presence of unusually long ivrs_acpihid or similar IOMMU-related arguments in /proc/cmdline.

Detection Strategies

Audit /proc/cmdline across the fleet and flag hosts with abnormally long or malformed ivrs_* arguments.
Monitor file integrity on bootloader configuration files and initramfs images.
Correlate kernel ring buffer entries (dmesg) from the IOMMU subsystem with recent boot parameter changes.

Monitoring Recommendations

Alert on write access to /etc/default/grub, /boot/grub/, and related bootloader paths by non-administrative accounts.
Track kernel package versions against the fixed builds identified in the Debian and upstream advisories.
Include boot configuration state in host inventory to detect drift from approved baselines.

How to Mitigate CVE-2025-38676

Immediate Actions Required

Identify Linux hosts running AMD hardware with vulnerable kernel versions, including Debian 11 systems and any builds based on 6.17-rc1 or 6.17-rc2.
Apply the vendor-supplied kernel updates from Debian LTS and upstream stable branches.
Restrict write access to bootloader configuration files to privileged administrators only.
Review boot configuration change history for unexpected modifications to IOMMU-related parameters.

Patch Information

The fix has been merged into multiple stable Linux kernel branches. Refer to the upstream commits: 0ad8509b468f, 4bdb0f78bddb, 736db11c86f0, 8503d0fcb108, 8f80c633cba1, 9ff52d3af0ef, and a732502bf3bb. Debian users should apply updates from Debian LTS Announcement msg00007 and Debian LTS Announcement msg00008. Siemens customers should consult Siemens Security Advisory SSA-032379.

Workarounds

Avoid passing maximum-length ivrs_acpihid or related IOMMU parameters on the kernel command line until the patch is applied.
Enforce secure boot and signed bootloader configurations to prevent unauthorized command line modifications.
Restrict physical and administrative access to systems where boot parameters can be altered.

bash

# Verify current kernel version and command line
uname -r
cat /proc/cmdline

# Debian: apply security updates
sudo apt update
sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')
sudo reboot