CVE-2025-38497

Q: What is the severity of CVE-2025-38497?

CVE-2025-38497 has a CVSS score of 7.1 (HIGH). This vulnerability in the Linux kernel's USB gadget configfs subsystem allows an out-of-bounds read when writing empty strings to specific sysfs attributes. Attackers with local access can potentially read kernel memory, leading to information disclosure or system crashes. Systems using USB gadget functionality with configfs are affected.

7.1 HIGH

Denial of Service

📋 TL;DR

This vulnerability in the Linux kernel's USB gadget configfs subsystem allows an out-of-bounds read when writing empty strings to specific sysfs attributes. Attackers with local access can potentially read kernel memory, leading to information disclosure or system crashes. Systems using USB gadget functionality with configfs are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE, but patches available for multiple stable branches

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if USB gadget configfs functionality is enabled and sysfs interface is accessible to local users.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory disclosure leading to privilege escalation, system crash, or information leakage of sensitive kernel data.

🟠

Likely Case

System crash or denial of service due to invalid memory access, potentially causing kernel panic.

🟢

If Mitigated

Minimal impact if systems don't use USB gadget configfs functionality or have restricted local access.

🌐 Internet-Facing: LOW - Requires local access to sysfs interface, not directly network exploitable.

🏢 Internal Only: MEDIUM - Local attackers or malicious users with shell access could exploit this to crash systems or leak information.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires local access to write to sysfs attributes. Simple to trigger but impact depends on memory layout.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with commits: 15a872068799, 22b7897c289c, 2798111f8e50, 3014168731b7, 58bdd5160184

Vendor Advisory: https://git.kernel.org/stable/c/15a87206879951712915c03c8952a73d6a74721e

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Restrict sysfs access

linux

Limit access to vulnerable sysfs attributes to prevent exploitation

chmod 600 /sys/kernel/config/usb_gadget/*/os_desc/qw_sign
chmod 600 /sys/kernel/config/usb_gadget/*/webusb/landingPage

Disable USB gadget configfs

linux

Remove or disable USB gadget configfs module if not needed

rmmod g_webusb
rmmod usb_f_webusb
echo 'blacklist g_webusb' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Implement strict access controls on /sys/kernel/config/usb_gadget/ directory
Monitor for unusual access to sysfs USB gadget attributes and implement alerting

🔍 How to Verify

Check if Vulnerable:

Check if USB gadget configfs is enabled and accessible: ls -la /sys/kernel/config/usb_gadget/

Check Version:

uname -r

Verify Fix Applied:

Check kernel version contains one of the fix commits: uname -r and verify with distribution patch notes

📡 Detection & Monitoring

Log Indicators:

Kernel oops or panic logs
Access denied errors to sysfs USB gadget paths
Unexpected writes to /sys/kernel/config/usb_gadget/*/os_desc/qw_sign or landingPage

Network Indicators:

None - local exploit only

SIEM Query:

source="kernel" AND ("Oops" OR "panic" OR "BUG") AND ("usb_gadget" OR "configfs")

📊 Metadata

CVE ID: CVE-2025-38497

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

EPSS Score: 0.01% exploit probability (2.4th percentile)

Published: July 28, 2025

Last Updated: January 7, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Restrict sysfs access

Disable USB gadget configfs

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities