CVE-2025-38380 Affecting kernel-rt-debug package, versions <0:5.14.0-570.35.1.el9_6


Severity

Recommended
high

Based on AlmaLinux security rating.

Threat Intelligence

EPSS
0.04% (13th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALMALINUX9-KERNELRTDEBUG-12162338
  • published23 Aug 2025
  • disclosed18 Aug 2025

Introduced: 18 Aug 2025

NewCVE-2025-38380  (opens in a new tab)

How to fix?

Upgrade AlmaLinux:9 kernel-rt-debug to version 0:5.14.0-570.35.1.el9_6 or higher.
This issue was patched in ALSA-2025:13962.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-rt-debug package and not the kernel-rt-debug package as distributed by AlmaLinux. See How to fix? for AlmaLinux:9 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

i2c/designware: Fix an initialization issue

The i2c_dw_xfer_init() function requires msgs and msg_write_idx from the dev context to be initialized.

amd_i2c_dw_xfer_quirk() inits msgs and msgs_num, but not msg_write_idx.

This could allow an out of bounds access (of msgs).

Initialize msg_write_idx before calling i2c_dw_xfer_init().

CVSS Base Scores

version 3.1