CVE-2025-38456: Debian Linux

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() The "intf" list iterator is an invalid pointer if the correct "intf->intf_num" is not found. Calling atomic_dec(&intf->nr_users) on and invalid pointer will lead to memory corruption. We don't really need to call atomic_dec() if we haven't called atomic_add_return() so update the if (intf->in_shutdown) path as well.

Affected products

• Debian Debian Linux: version 11.0 only
• Linux Linux Kernel: from 5.19, before 6.1.146 (fixed in 6.1.146); from 6.2, before 6.6.99 (fixed in 6.6.99); from 6.7, before 6.12.39 (fixed in 6.12.39); from 6.13, before 6.15.7 (fixed in 6.15.7)

Published 2025-07-25. Last modified 2026-07-30.