What’s Vulnerable › Vulnerabilities

CVE-2025-38422: net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-25 · updated 2026-07-30

Description

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices Maximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb and 64 Kb respectively. Adjust max size definitions and return correct EEPROM length based on device. Also prevent out-of-bound read/write.

Affected products

• Debian Linux: 11.0
• Linux kernel: from 4.19 before 6.1.142; from 6.2 before 6.6.95; from 6.7 before 6.12.35; from 6.13 before 6.15.4 — fixed in 6.1.142, 6.12.35, 6.15.4, 6.6.95

How to fix

Upgrade to a fixed version: Linux kernel 6.1.142, 6.12.35, 6.15.4, 6.6.95. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/088279ff18cdc437d6fac5890e0c52c624f78a5b
• https://git.kernel.org/stable/c/3b9935586a9b54d2da27901b830d3cf46ad66a1e
• https://git.kernel.org/stable/c/51318d644c993b3f7a60b8616a6a5adc1e967cd2
• https://git.kernel.org/stable/c/6b4201d74d0a49af2123abf2c9d142e59566714b
• https://git.kernel.org/stable/c/9c41d2a2aa3817946eb613522200cab55513ddaa
• https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html

Get alerted when CVE-2025-38422 or the next vulnerability affects your stack