CVE-2025-38342: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38342 is an out-of-bounds read vulnerability in the Linux kernel's software node subsystem, specifically in the software_node_get_reference_args() function. The flaw stems from an incorrect bounds check that fails to verify whether the property value buffer contains sufficient bytes for the requested index, potentially allowing access to memory beyond the allocated buffer. It affects Linux kernel versions 5.0 through 6.15.3 across multiple stable branches, and was published on July 10, 2025. It carries a CVSS v3.1 base score of 7.1 (High) (Red Hat CVE, Feedly).

The root cause is classified as CWE-125 (Out-of-bounds Read). The software_node_get_reference_args() function attempts to retrieve the @index-th element from a property value, but the existing OOB check only validates index * sizeof(*ref) < prop->length rather than the correct (index + 1) * sizeof(*ref) > prop->length. This means a malformed property with insufficient bytes can pass the check and trigger an out-of-bounds read when the function accesses memory beyond the property buffer. The attack vector is local, requires low privileges, and no user interaction, making it exploitable by any unprivileged local user who can influence software node property data (Red Hat CVE, Feedly).

Successful exploitation can result in high confidentiality impact — a low-privileged local attacker may read sensitive kernel memory contents — and high availability impact, as the out-of-bounds read could cause kernel instability or system crashes. Integrity is not directly affected. The scope is limited to the local system, but kernel memory disclosure could expose credentials, cryptographic material, or other sensitive data that could facilitate further privilege escalation (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

The Linux kernel project has released patches across all affected stable branches. Users should update to the following fixed versions or later: 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, 6.15.4, or 6.16-rc1 (Feedly, Red Hat CVE). Downstream distributions including Ubuntu (USN-7774-1, USN-7774-3, USN-7775-3, USN-7776-1, USN-7834-1) and Amazon Linux 2 (ALAS2KERNEL-5.15-2025-082, ALAS2KERNEL-5.10-2025-098) have also issued updated kernel packages. As a compensating control, restricting local user access and minimizing the attack surface for unprivileged users is recommended until patching is complete.