{"id":"CVE-2025-38239","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: megaraid_sas: Fix invalid node index\n\nOn a system with DRAM interleave enabled, out-of-bound access is\ndetected:\n\nmegaraid_sas 0000:3f:00.0: requested/available m…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: megaraid_sas: Fix invalid node index\n\nOn a system with DRAM interleave enabled, out-of-bound access is\ndetected:\n\nmegaraid_sas 0000:3f:00.0: requested/available m…","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","cwe":["CWE-129"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.17, < 6.1.143","linux_kernel >= 6.2, < 6.6.96","linux_kernel >= 6.7, < 6.12.36","linux_kernel >= 6.13, < 6.15.5","linux_kernel = 6.16","debian_linux = 11.0"],"patched":["linux_kernel 6.15.5"],"published":"2025-07-09","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:18:36.197","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-38239","references":[{"url":"https://git.kernel.org/stable/c/074efb35552556a4b3b25eedab076d5dc24a8199","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/19a47c966deb36624843b7301f0373a3dc541a05","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/752eb816b55adb0673727ba0ed96609a17895654","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf2c1643abc3b2507d56bb6c22bf9897272f8a35","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1064b3532192e987ab17be7281d5fee36fd25e1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"epss":0.00177,"epssPercentile":0.07189,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T21:48:47.838370Z"},"ingestedAt":"2026-10-15T22:48:25.499Z","slug":"CVE-2025-38239","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: megaraid_sas: Fix invalid node index\n\nOn a system with DRAM interleave enabled, out-of-bound access is\ndetected:\n\nmegaraid_sas 0000:3f:00.0: requested/available msix 128/128 poll_queue 0\n------------[ cut here ]------------\nUBSAN: array-index-out-of-bounds in ./arch/x86/include/asm/topology.h:72:28\nindex -1 is out of range for type 'cpumask *[1024]'\ndump_stack_lvl+0x5d/0x80\nubsan_epilogue+0x5/0x2b\n__ubsan_handle_out_of_bounds.cold+0x46/0x4b\nmegasas_alloc_irq_vectors+0x149/0x190 [megaraid_sas]\nmegasas_probe_one.cold+0xa4d/0x189c [megaraid_sas]\nlocal_pci_probe+0x42/0x90\npci_device_probe+0xdc/0x290\nreally_probe+0xdb/0x340\n__driver_probe_device+0x78/0x110\ndriver_probe_device+0x1f/0xa0\n__driver_attach+0xba/0x1c0\nbus_for_each_dev+0x8b/0xe0\nbus_add_driver+0x142/0x220\ndriver_register+0x72/0xd0\nmegasas_init+0xdf/0xff0 [megaraid_sas]\ndo_one_initcall+0x57/0x310\ndo_init_module+0x90/0x250\ninit_module_from_file+0x85/0xc0\nidempotent_init_module+0x114/0x310\n__x64_sys_finit_module+0x65/0xc0\ndo_syscall_64+0x82/0x170\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFix it accordingly.\n\n## Affected\n\n- `linux_kernel >= 5.17, < 6.1.143`\n- `linux_kernel >= 6.2, < 6.6.96`\n- `linux_kernel >= 6.7, < 6.12.36`\n- `linux_kernel >= 6.13, < 6.15.5`\n- `linux_kernel = 6.16`\n- `debian_linux = 11.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.15.5`","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}