CVE-2025-38133
Last modified
CVE-2025-38133 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4851: fix ad4858 chan pointer handling The pointer returned from ad4851_parse_channels_common() is incremented internally as each channel is populated. In ad4858_parse_channels(), the same pointer was further incremented while setting ext_scan_type fields for each channel. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4851: fix ad4858 chan pointer handling The pointer returned from ad4851_parse_channels_common() is incremented internally as each channel is populated. In ad4858_parse_channels(), the same pointer was further incremented while setting ext_scan_type fields for each channel. This resulted in indio_dev->channels being set to a pointer past the end of the allocated array, potentially causing memory corruption or undefined behavior. Fix this by iterating over the channels using an explicit index instead of incrementing the pointer. This preserves the original base pointer and ensures all channel metadata is set correctly.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 6.15, < 6.15.3 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2025-38133?
How severe is CVE-2025-38133?
How do I fix CVE-2025-38133?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-38128In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2025-38129In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2025-3813The Royal Elementor Addons and Templates plugin for WordPres…5.4
- CVE-2025-38130In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2025-38131In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2025-38132In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2025-38134In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2025-38135In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2025-38136In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2025-38137In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2025-38138In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2025-38139In the Linux kernel, the following vulnerability has been re…7.1
Are you affected by CVE-2025-38133?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST
