CVE-2025-38548

Q: What is the severity of CVE-2025-38548?

CVE-2025-38548 has a CVSS score of 7.8 (HIGH). This CVE addresses a buffer overflow vulnerability in the Linux kernel's corsair-cpro hardware monitoring driver. Attackers could exploit this by sending specially crafted USB commands to cause kernel memory corruption, potentially leading to system crashes or privilege escalation. Systems using affected Linux kernel versions with the corsair-cpro driver loaded are vulnerable.

7.8 HIGH

Buffer Overflow

📋 TL;DR

This CVE addresses a buffer overflow vulnerability in the Linux kernel's corsair-cpro hardware monitoring driver. Attackers could exploit this by sending specially crafted USB commands to cause kernel memory corruption, potentially leading to system crashes or privilege escalation. Systems using affected Linux kernel versions with the corsair-cpro driver loaded are vulnerable.

💻 Affected Systems

Products:

Linux kernel with corsair-cpro driver

Versions: Linux kernel versions before the fix commits (specific versions depend on distribution backports)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when corsair-cpro driver is loaded (typically when Corsair PSU devices are connected). Most systems won't have this driver loaded by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to root, kernel panic causing system crash, or arbitrary code execution in kernel context.

🟠

Likely Case

System instability, kernel crashes (oops/panic), or denial of service affecting hardware monitoring functionality.

🟢

If Mitigated

Minimal impact if driver not loaded or USB access restricted; crashes contained to kernel space without privilege escalation.

🌐 Internet-Facing: LOW - Requires physical or local USB device access, not remotely exploitable over network.

🏢 Internal Only: MEDIUM - Local attackers with USB device access could exploit; risk increases in shared/multi-user systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires physical USB device access or ability to send malicious USB commands; kernel exploitation requires additional steps beyond buffer overflow.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 0db770e2922389753ddbd6663a5516a32b97b743 and related fixes

Vendor Advisory: https://git.kernel.org/stable/c/0db770e2922389753ddbd6663a5516a32b97b743

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system to load patched kernel.

🔧 Temporary Workarounds

Disable corsair-cpro driver

linux

Prevent loading of vulnerable driver module

echo 'blacklist corsair-cpro' >> /etc/modprobe.d/blacklist-corsair.conf
rmmod corsair-cpro

Restrict USB device access

linux

Limit which users can access USB devices

chmod 600 /dev/bus/usb/*/*
setfacl -m u:root:rw /dev/bus/usb/*/*

🧯 If You Can't Patch

Disconnect Corsair PSU devices that trigger driver loading
Implement strict physical security controls for USB ports

🔍 How to Verify

Check if Vulnerable:

Check if corsair-cpro module is loaded: lsmod | grep corsair-cpro

Check Version:

uname -r

Verify Fix Applied:

Check kernel version contains fix commits: grep -i corsair /proc/version || check distribution kernel changelog

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages mentioning corsair-cpro
System crashes/panics after USB device connection
dmesg errors related to USB buffer overflows

Network Indicators:

None - local USB exploit only

SIEM Query:

source="kernel" AND ("corsair-cpro" OR "buffer overflow" OR "general protection fault")

📊 Metadata

CVE ID: CVE-2025-38548

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score: 0.01% exploit probability (2.4th percentile)

Published: August 16, 2025

Last Updated: January 7, 2026

🔗 References

https://git.kernel.org/stable/c/0db770e2922389753ddbd6663a5516a32b97b743 Patch
https://git.kernel.org/stable/c/2771d2ee3d95700f34e1e4df6a445c90565cd4e9 Patch
https://git.kernel.org/stable/c/2e6f4d9cfbda52700c126c5a2b93dd2042e8680c Patch
https://git.kernel.org/stable/c/3c4bdc8a852e446080adc8ceb90ddd67a56e1bb8 Patch
https://git.kernel.org/stable/c/495a4f0dce9c8c4478c242209748f1ee9e4d5820 Patch
https://git.kernel.org/stable/c/4eb5cc48399f89b63acdbfe912fa5c8fe2900147 Patch
https://git.kernel.org/stable/c/eda5e38cc4dd2dcb422840540374910ef2818494 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory,Mailing List
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory,Mailing List

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable corsair-cpro driver

Restrict USB device access

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export