Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]drivers/rapidio/rio_cm.c: prevent possible heap overwrite[EOL][EOL]In[EOL][EOL]riocm_cdev_ioctl(RIO_CM_CHAN_SEND)[EOL]   -> cm_chan_msg_send()[EOL]      -> riocm_ch_send()[EOL][EOL]cm_chan_msg_send() checks that userspace didn't send too much data but[EOL]riocm_ch_send() failed to check that userspace sent sufficient data.  The[EOL]result is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr[EOL]which were outside the bounds of the space which cm_chan_msg_send()[EOL]allocated.[EOL][EOL]Address this by teaching riocm_ch_send() to check that the entire[EOL]rio_ch_chan_hdr was copied in from userspace.

CREATE(Triage):(User=lchen-cn) [CVE-2025-38090 (https://nvd.nist.gov/vuln/detail/CVE-2025-38090)