In the Linux kernel, the following vulnerability has been resolved: ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 The controller has a hardware bug that can hard hang the system when doing ATAPI DMAs without any trace of what happened. Depending on the device attached, it can also prevent the system from booting. In this case, the system hangs when reading the ATIP from optical media with cdrecord -vvv -atip on an _NEC DVD_RW ND-4571A 1-01 and an Optiarc DVD RW AD-7200A 1.06 attached to an ASRock 990FX Extreme 4, running at UDMA/33. The issue can be reproduced by running the same command with a cygwin build of cdrecord on WinXP, although it requires more attempts to cause it. The hang in that case is also resolved by forcing PIO. It doesn't appear that VIA has produced any drivers for that OS, thus no known workaround exists. HDDs attached to the controller do not suffer from any DMA issues.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

No data.

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/0d9a48dfa934f43ac839211ae4aeba34f666a9a5 cve-icon cve-icon
https://git.kernel.org/stable/c/67d66a5e4583fd3bcf13d6f747e571df13cbad51 cve-icon cve-icon
https://git.kernel.org/stable/c/7fc89c218fc96a296a2840b1e37f4e0975f7a108 cve-icon cve-icon
https://git.kernel.org/stable/c/8212cd92fe40aae6fe5a073bc70e758c42bb4bfc cve-icon cve-icon
https://git.kernel.org/stable/c/8edfed4439b107d62151ff6c075958d169da3e71 cve-icon cve-icon
https://git.kernel.org/stable/c/947f9304d3c876c6672b947b80c0ef51161c6d2f cve-icon cve-icon
https://git.kernel.org/stable/c/bb7212ee4ff086628a2c1c22336d082a87cb893d cve-icon cve-icon
https://git.kernel.org/stable/c/d29fc02caad7f94b62d56ee1b01c954f9c961ba7 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025071034-CVE-2025-38336-ab73@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-38336 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-38336 cve-icon
History

Fri, 11 Jul 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Thu, 10 Jul 2025 08:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 The controller has a hardware bug that can hard hang the system when doing ATAPI DMAs without any trace of what happened. Depending on the device attached, it can also prevent the system from booting. In this case, the system hangs when reading the ATIP from optical media with cdrecord -vvv -atip on an _NEC DVD_RW ND-4571A 1-01 and an Optiarc DVD RW AD-7200A 1.06 attached to an ASRock 990FX Extreme 4, running at UDMA/33. The issue can be reproduced by running the same command with a cygwin build of cdrecord on WinXP, although it requires more attempts to cause it. The hang in that case is also resolved by forcing PIO. It doesn't appear that VIA has produced any drivers for that OS, thus no known workaround exists. HDDs attached to the controller do not suffer from any DMA issues.
Title ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-07-10T08:15:07.700Z

Updated: 2025-07-10T08:15:07.700Z

Reserved: 2025-04-16T04:51:24.005Z

Link: CVE-2025-38336

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-07-10T09:15:28.230

Modified: 2025-07-10T13:17:30.017

Link: CVE-2025-38336

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-07-10T00:00:00Z

Links: CVE-2025-38336 - Bugzilla