CVE-2025-38336
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
10/07/2025
Last modified:
16/12/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330<br />
<br />
The controller has a hardware bug that can hard hang the system when<br />
doing ATAPI DMAs without any trace of what happened. Depending on the<br />
device attached, it can also prevent the system from booting.<br />
<br />
In this case, the system hangs when reading the ATIP from optical media<br />
with cdrecord -vvv -atip on an _NEC DVD_RW ND-4571A 1-01 and an<br />
Optiarc DVD RW AD-7200A 1.06 attached to an ASRock 990FX Extreme 4,<br />
running at UDMA/33.<br />
<br />
The issue can be reproduced by running the same command with a cygwin<br />
build of cdrecord on WinXP, although it requires more attempts to cause<br />
it. The hang in that case is also resolved by forcing PIO. It doesn&#39;t<br />
appear that VIA has produced any drivers for that OS, thus no known<br />
workaround exists.<br />
<br />
HDDs attached to the controller do not suffer from any DMA issues.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.4.295 (excluding) | |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.5 (including) | 5.10.239 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.11 (including) | 5.15.186 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 6.1.142 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.2 (including) | 6.6.95 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.12.35 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.15.4 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/0d9a48dfa934f43ac839211ae4aeba34f666a9a5
- https://git.kernel.org/stable/c/67d66a5e4583fd3bcf13d6f747e571df13cbad51
- https://git.kernel.org/stable/c/7fc89c218fc96a296a2840b1e37f4e0975f7a108
- https://git.kernel.org/stable/c/8212cd92fe40aae6fe5a073bc70e758c42bb4bfc
- https://git.kernel.org/stable/c/8edfed4439b107d62151ff6c075958d169da3e71
- https://git.kernel.org/stable/c/947f9304d3c876c6672b947b80c0ef51161c6d2f
- https://git.kernel.org/stable/c/bb7212ee4ff086628a2c1c22336d082a87cb893d
- https://git.kernel.org/stable/c/d29fc02caad7f94b62d56ee1b01c954f9c961ba7
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html



