ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
In the Linux kernel, the following vulnerability has been resolved: ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 The controller has a hardware bug that can hard hang the system when doing ATAPI DMAs without any trace of what happened. Depending on the device attached, it can also prevent the system from booting. In this case, the system hangs when reading the ATIP from optical media with cdrecord -vvv -atip on an _NEC DVD_RW ND-4571A 1-01 and an Optiarc DVD RW AD-7200A 1.06 attached to an ASRock 990FX Extreme 4, running at UDMA/33. The issue can be reproduced by running the same command with a cygwin build of cdrecord on WinXP, although it requires more attempts to cause it. The hang in that case is also resolved by forcing PIO. It doesn't appear that VIA has produced any drivers for that OS, thus no known workaround exists. HDDs attached to the controller do not suffer from any DMA issues.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Linux | Linux | 2.6.27.19 to before 2.6.28; 2.6.28.7 to before 2.6.29 | 2.6.28, 2.6.29 | Patch available | CNA |
| Linux | Linux | 2.6.29 and later | 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, 6.15.4, 6.16 | Patch available | CNA |
- Linux VendorLinux Affected 2.6.27.19 to before 2.6.28; 2.6.28.7 to before 2.6.29 Fixed in 2.6.28, 2.6.29 Patch available CNA
- Linux VendorLinux Affected 2.6.29 and later Fixed in 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, 6.15.4, 6.16 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | before 5.4.295; 5.5 to before 5.10.239; 5.11 to before 5.15.186; 5.16 to before 6.1.142; 6.2 to before 6.6.95; 6.7 to before 6.12.35; 6.13 to before 6.15.4 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:* | 6.16 rc1 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:* | 6.16 rc2 | Vulnerable | Linux |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions before 5.4.295; 5.5 to before 5.10.239; 5.11 to before 5.15.186; 5.16 to before 6.1.142; 6.2 to before 6.6.95; 6.7 to before 6.12.35; 6.13 to before 6.15.4 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:* Versions 6.16 rc1 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:* Versions 6.16 rc2 Vulnerable ·Linux
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
- Fix · CNA Linux (Linux) Fixed in 2.6.28, 2.6.29
- Fix · CNA Linux (Linux) Fixed in 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, 6.15.4, 6.16
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
Not affected: 3 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2025-38336
- 2026-10-03 Alias added: GHSA-9hq4-mpvh-wv3q
- 2026-11-05 CISA SSVC decision points changed
References
Patch 8
- https://git.kernel.org/stable/c/67d66a5e4583fd3bcf13d6f747e571df13cbad51
- https://git.kernel.org/stable/c/0d9a48dfa934f43ac839211ae4aeba34f666a9a5
- https://git.kernel.org/stable/c/7fc89c218fc96a296a2840b1e37f4e0975f7a108
- https://git.kernel.org/stable/c/8212cd92fe40aae6fe5a073bc70e758c42bb4bfc
- https://git.kernel.org/stable/c/8edfed4439b107d62151ff6c075958d169da3e71
- https://git.kernel.org/stable/c/947f9304d3c876c6672b947b80c0ef51161c6d2f
- https://git.kernel.org/stable/c/bb7212ee4ff086628a2c1c22336d082a87cb893d
- https://git.kernel.org/stable/c/d29fc02caad7f94b62d56ee1b01c954f9c961ba7
More Linux Kernel vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
- TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
Sources
- CVE-2025-38336 · CVE Program
- CVE-2025-38336 · NVD
- FIRST EPSS
- GHSA-9hq4-mpvh-wv3q · GitHub Advisory Database · CC BY 4.0
- CVE-2025-38336 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences