CVE-2025-38348

CVE-2025-38348 is a buffer overflow vulnerability in the Linux kernel's p54 Wi-Fi driver, specifically within the p54_rx_eeprom_readback() function. This flaw allows a malicious USB device, masquerading as an Intersil p54 Wi-Fi interface, to send a crafted eeprom_readback message with an oversized length, leading to data being copied beyond allocated memory. It primarily affects various Debian Linux kernel versions. Rated 7.8 HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), this vulnerability requires local access (AV:L, PR:L) but has low attack complexity (AC:L). Successful exploitation can result in high impact on confidentiality, integrity, and availability (C:H, I:H, A:H), potentially leading to system crashes or arbitrary code execution. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is currently available. Despite this, the vulnerability has garnered significant community attention with 2 mentions and 2 media articles, indicating awareness and discussion within the cybersecurity community.