Login Sign Up

CVE-2025-38043

5.5 MEDIUM

📋 TL;DR

This CVE addresses a missing DMA mask configuration in the Linux kernel's ARM Firmware Framework for Armv8-A (FFA) driver, which causes kernel warnings during DMA allocation operations. The vulnerability affects Linux systems with ARM processors using the FFA framework. While it doesn't enable direct exploitation, it can cause system instability and potential denial of service.

💻 Affected Systems

Products:
  • Linux Kernel
Versions: Kernel versions with the vulnerable FFA driver implementation (specific versions not specified in CVE, but patches available for multiple stable branches)
Operating Systems: Linux distributions running on ARM architecture
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects systems with ARM processors using the Firmware Framework for Armv8-A (FFA) feature. Requires CONFIG_ARM_FFA_TRANSPORT kernel configuration.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

System crash or kernel panic due to improper DMA operations, leading to denial of service and potential data corruption in memory-sensitive operations.

🟠

Likely Case

Kernel warning messages in system logs and potential performance degradation during DMA operations, but no direct security compromise.

🟢

If Mitigated

Minor system logging overhead with no security impact when proper kernel patches are applied.

🌐 Internet-Facing: LOW - This is a kernel-level driver issue requiring local access or kernel module interaction, not directly exploitable over network.
🏢 Internal Only: MEDIUM - Local users or processes with appropriate privileges could trigger the warning condition, potentially affecting system stability.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: NO
Unauthenticated Exploit: ✅ No
Complexity: HIGH

This is a configuration issue causing warnings rather than a traditional security vulnerability. Exploitation would require triggering specific DMA operations through the FFA interface.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with commits: 2e62c803feec1ef5847d8fa47dd0de039abfa378, 3a3efeef64364c2a028cf0d03d68c831813a97fd, 97bab02f0b64ba6bcdf6a8fae561db07f509aee9, c6aa1d6bd6ccff4ecdf064d288817657ec8532f0, cc0aac7ca17e0ea3ca84b552fc79f3e86fd07f53

Vendor Advisory: https://git.kernel.org/stable/c/2e62c803feec1ef5847d8fa47dd0de039abfa378

Restart Required: Yes

Instructions:

1. Update Linux kernel to a patched version containing the fix commits. 2. Reboot system to load new kernel. 3. For distributions: Use package manager (apt/yum/dnf) to update kernel package.

🔧 Temporary Workarounds

Disable FFA driver

linux

Disable the ARM FFA driver if not required for system functionality

echo "blacklist arm_ffa" >> /etc/modprobe.d/blacklist.conf
rmmod arm_ffa

🧯 If You Can't Patch

  • Monitor system logs for DMA allocation warnings and investigate processes triggering them
  • Restrict user access to systems with ARM FFA functionality to trusted users only

🔍 How to Verify

Check if Vulnerable:

Check kernel logs for 'WARNING: CPU: 1 PID: 1 at kernel/dma/mapping.c:597 dma_alloc_attrs' messages or verify if FFA driver is loaded without DMA mask

Check Version:

uname -r

Verify Fix Applied:

Check kernel version includes fix commits or verify no DMA allocation warnings appear in logs after patch

📡 Detection & Monitoring

Log Indicators:

  • WARNING: CPU: 1 PID: 1 at kernel/dma/mapping.c:597 dma_alloc_attrs+0xe0/0x124
  • DMA allocation failures in kernel logs

Network Indicators:

  • None - this is a local kernel issue

SIEM Query:

source="kernel" AND "dma_alloc_attrs" AND "WARNING"

📊 Metadata

CVE ID: CVE-2025-38043
CVSS v3 Score: 5.5 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score: 0.03% exploit probability (7th percentile)
Published: June 18, 2025
Last Updated: December 17, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON