Menu

Star on GitHub · 3.2k

CVE-2025-38042

5.5 · MEDIUM

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn The user of k3_udma_glue_reset_rx_chn() e.g.

Published Jun 18, 2025EPSS 0.16%

Overview

CVE-2025-38042 is a medium-severity vulnerability. It was published on June 18, 2025 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn

The user of k3_udma_glue_reset_rx_chn() e.g. ti_am65_cpsw_nuss can

run on multiple platforms having different DMA architectures.

On some platforms there can be one FDQ for all flows in the RX channel

while for others there is a separate FDQ for each flow in the RX channel.

So far we have been relying on the skip_fdq argument of

k3_udma_glue_reset_rx_chn().

Instead of relying on the user to provide this information, infer it

based on DMA architecture during k3_udma_glue_request_rx_chn() and save it

in an internal flag 'single_fdq'. Use that flag at

k3_udma_glue_reset_rx_chn() to deicide if the FDQ needs

to be cleared for every flow or just for flow 0.

Fixes the below issue on ti_am65_cpsw_nuss driver on AM62-SK.

> ip link set eth1 down

> ip link set eth0 down

> ethtool -L eth0 rx 8

> ip link set eth0 up

> modprobe -r ti_am65_cpsw_nu

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Frequently asked questions

What is CVE-2025-38042?

CVE-2025-38042 is a medium-severity vulnerability. It was published on June 18, 2025 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2025-38042?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2025-38042?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2025-38042?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2025-38042 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related MEDIUM CVEs from 2025

View all